Remote Code Execution (RCE)

@theia/mini-browser is vulnerable to remote code execution. An attacker is able to exploit the vulnerability by viewing the HTML files in an iframe inside the IDE and injecting malicious code via HTML tag...

@popcornsar/che-theia-plugin-ext (7.4.0), @popcornsar/theia-dashboard-extension (7.4.0-v1) +8 more potentially affected by CVE-2021-34435 via @theia/mini-browser (>=0.3.19, <=1.8.0-next.61200efc)

@theia/mini-browser NPM version =0.3.19, =0.1.2, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.13.0-next.0860ab1b, =0.3.14, =0.0.4, =0.0.33 - coffee-workflow-analyzer 1.0.1 Source cves: CVE-2021-34435 Source advisory: OSV:GHSA-V9W2-V7J9-RJPR...

@theia/plantuml (>=0.1.2, <=0.1.7), @theia/plugin-dev (>=0.9.0-next.d57c6a91, <=0.13.0-next.fb398d67) +6 more potentially affected by CVE-2019-17636 via @theia/mini-browser (>=0.3.19, <=0.15.0-next.87487802)

@theia/mini-browser NPM version =0.3.19, =0.1.2, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.13.0-next.0860ab1b, =0.3.14, =0.0.4, =0.0.33 - coffee-workflow-analyzer 1.0.1 Source cves: CVE-2019-17636 Source advisory: OSV:GHSA-F7VX-J8MP-3H2X...