Remote Code Execution (RCE)

@theia/mini-browser is vulnerable to remote code execution. An attacker is able to exploit the vulnerability by viewing the HTML files in an iframe inside the IDE and injecting malicious code via HTML tag...

@popcornsar/che-theia-plugin-ext (7.4.0), @popcornsar/theia-dashboard-extension (7.4.0-v1) +8 more potentially affected by CVE-2021-34435 via @theia/mini-browser (>=0.3.19, <=1.9.0-next.f1e37fbd)

@theia/mini-browser NPM version =0.3.19, =0.1.2, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.13.0-next.0860ab1b, =0.3.14, =0.0.4, =0.0.33 - coffee-workflow-analyzer 1.0.1 Source cves: CVE-2021-34435 Source advisory: OSV:GHSA-V9W2-V7J9-RJPR...

@popcornsar/che-theia-plugin-ext (7.4.0), @popcornsar/theia-dashboard-extension (7.4.0-v1) +8 more potentially affected by CVE-2021-34435 via @theia/mini-browser (>=0.3.19, <=1.9.0-next.f1e37fbd)

@theia/mini-browser NPM version =0.3.19, =0.1.2, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.13.0-next.0860ab1b, =0.3.14, =0.0.4, =0.0.33 - coffee-workflow-analyzer 1.0.1 Source cves: CVE-2021-34435 Source advisory: GHSA-V9W2-V7J9-RJPR...

@popcornsar/che-theia-plugin-ext (7.4.0), @popcornsar/theia-dashboard-extension (7.4.0-v1) +8 more potentially affected by CVE-2021-34435 via @theia/mini-browser (>=0.3.19, <=1.9.0-next.f1e37fbd)

@theia/mini-browser NPM version =0.3.19, =0.1.2, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.13.0-next.0860ab1b, =0.3.14, =0.0.4, =0.0.33 - coffee-workflow-analyzer 1.0.1 Source cves: CVE-2021-34435 Source advisory: MEND:CVE-2021-34435...

@theia/plantuml (>=0.1.2, <=0.1.7), @theia/plugin-dev (>=0.9.0-next.d57c6a91, <=0.13.0-next.fb398d67) +6 more potentially affected by CVE-2019-17636 via @theia/mini-browser (>=0.3.19, <=0.16.0-next.f114ded2)

@theia/mini-browser NPM version =0.3.19, =0.1.2, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.13.0-next.0860ab1b, =0.3.14, =0.0.4, =0.0.33 - coffee-workflow-analyzer 1.0.1 Source cves: CVE-2019-17636 Source advisory: OSV:GHSA-F7VX-J8MP-3H2X...

@theia/plantuml (>=0.1.2, <=0.1.7), @theia/plugin-dev (>=0.9.0-next.d57c6a91, <=0.13.0-next.fb398d67) +6 more potentially affected by CVE-2019-17636 via @theia/mini-browser (>=0.3.19, <=0.16.0-next.f114ded2)

@theia/mini-browser NPM version =0.3.19, =0.1.2, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.13.0-next.0860ab1b, =0.3.14, =0.0.4, =0.0.33 - coffee-workflow-analyzer 1.0.1 Source cves: CVE-2019-17636 Source advisory: GHSA-F7VX-J8MP-3H2X...

CVE-2019-17636

In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of files on the host's filesystem, given...

@theia/plantuml (>=0.1.2, <=0.1.7), @theia/plugin-dev (>=0.9.0-next.d57c6a91, <=0.13.0-next.fb398d67) +6 more potentially affected by CVE-2019-17636 via @theia/mini-browser (>=0.3.19, <=0.16.0-next.f114ded2)

@theia/mini-browser NPM version =0.3.19, =0.1.2, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.13.0-next.0860ab1b, =0.3.14, =0.0.4, =0.0.33 - coffee-workflow-analyzer 1.0.1 Source cves: CVE-2019-17636 Source advisory: MEND:CVE-2019-17636...

PT-2020-9929

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions 0.3.9 through 0.15.0 Description The issue concerns the "Mini-Browser" extension, published as "@theia/mini-browser" on npmjs.com, which is one of the default pre-packaged Theia extensions. This extension exposes an HTTP...