Eclipse · Eclipse Theia · CVE-2021-34435
Name of the Vulnerable Software and Affected Versions:
Eclipse Theia versions 0.3.9 through 1.8.1
Description:
The issue allows a previewed HTML file to trigger a remote code execution (RCE) in the Eclipse Theia IDE, specifically through the "mini-browser" extension. This exploit occurs when a user previews a malicious HTML file within the IDE's iframe.
Recommendations:
For Eclipse Theia versions 0.3.9 through 1.8.1, consider disabling the "mini-browser" extension as a temporary workaround to prevent the exploitation of this issue until a patch is available. Restrict access to previewing HTML files within the IDE to minimize the risk of RCE.