Inclusion of Functionality from Untrusted Control Sphere

Overview @theia/plugin-ext-vscode is a Theia - Plugin Extension for VsCode Affected versions of this package are vulnerable to Inclusion of Functionality from Untrusted Control Sphere due to missing workspace-trust enforcement in the plugin and extension loading path. An attacker can execute...

Inclusion of Functionality from Untrusted Control Sphere

Overview @theia/plugin-ext is a Theia - Plugin Extension Affected versions of this package are vulnerable to Inclusion of Functionality from Untrusted Control Sphere due to missing workspace-trust enforcement in the plugin and extension loading path. An attacker can execute commands with the user...

@popcornsar/che-theia-plugin-ext (7.4.0), @popcornsar/theia-dashboard-extension (7.4.0-v1) +16 more potentially affected by CVE-2026-19884 via @theia/plugin-ext (>=1.0.0, <=1.70.0-next.81)

@theia/plugin-ext NPM version =1.0.0, =1.1.0-next.14531578, =1.46.0-next.72, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.59.0, =0.0.17, =0.0.6, =0.0.19, =0.0.6, =0.0.21 and more Source cves: CVE-2026-19884 Source advisory: SNYK:JS-THEIAPLUGINEXT-18855352...

@theia/vsx-registry (>=1.1.0-next.14531578, <=1.70.0-next.81), openvsx-server (>=1.59.0, <=1.59.1) potentially affected by CVE-2026-19884 via @theia/plugin-ext-vscode (>=1.1.0-next.14531578, <=1.70.0-next.81)

@theia/plugin-ext-vscode NPM version =1.1.0-next.14531578, =1.1.0-next.14531578, =1.59.0, =1.59.1 Source cves: CVE-2026-19884 Source advisory: SNYK:JS-THEIAPLUGINEXTVSCODE-18855353...

@theia/ai-registry (>=1.73.0-next.2, <=1.74.0-next.70), @theia/plugin-dev (>=1.66.0, <=1.74.0-next.70) +4 more potentially affected by CVE-2026-12609 via @theia/plugin-ext (>=1.66.0, <=1.74.0-next.70)

@theia/plugin-ext NPM version =1.66.0, =1.73.0-next.2, =1.66.0, =1.66.0, =1.66.0, =1.66.0, =1.66.0, =1.74.0-next.70 Source cves: CVE-2026-12609 Source advisory: SNYK:JS-THEIAPLUGINEXT-18565098...

@theia/ai-registry (>=1.73.0-next.2, <=1.74.0-next.70), @theia/plugin-dev (>=1.66.0, <=1.74.0-next.70) +4 more potentially affected by CVE-2026-12609 via @theia/plugin-ext (>=1.66.0, <=1.74.0-next.70)

@theia/plugin-ext NPM version =1.66.0, =1.73.0-next.2, =1.66.0, =1.66.0, =1.66.0, =1.66.0, =1.66.0, =1.74.0-next.70 Source cves: CVE-2026-12609 Source advisory: MEND:CVE-2026-12609...

PT-2026-68091

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions 1.66.0 through 1.73.1 Description The @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path HTTP endpoint. The system resolves the requested file path using the path.resolvelocalPath, filePath function...

CVE-2026-12609: Improper Limitation of a Pathname to a Restricted Directory

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path HTTP endpoint, which resolves the requested file path with path.resolvelocalPath, filePath without verifying that the resolved path stays within the plugin's...

@popcornsar/che-theia-plugin-ext (7.4.0), @popcornsar/theia-dashboard-extension (7.4.0-v1) +11 more potentially affected by CVE-2021-41038 via @theia/plugin-ext (>=1.0.0, <=1.18.0-next.ed824933)

@theia/plugin-ext NPM version =1.0.0, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =0.0.17, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.19 Source cves: CVE-2021-41038 Source advisory: GHSA-W6V7-W58J-PG5R...

@popcornsar/che-theia-plugin-ext (7.4.0), @popcornsar/theia-dashboard-extension (7.4.0-v1) +11 more potentially affected by CVE-2021-41038 via @theia/plugin-ext (>=1.0.0, <=1.18.0-next.ed824933)

@theia/plugin-ext NPM version =1.0.0, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =0.0.17, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.19 Source cves: CVE-2021-41038 Source advisory: OSV:GHSA-W6V7-W58J-PG5R...

Improper Verification of Communication Channel in @theia/plugin-ext

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage...

@jpinkney/plugin (>=0.0.1-1583345065, <=0.0.1-1583345396), @popcornsar/che-theia-plugin-ext (7.4.0) +14 more potentially affected by CVE-2021-41038 via @theia/plugin-ext (>=0.3.19, <=1.18.0-next.ed824933)

@theia/plugin-ext NPM version =0.3.19, =0.0.1-1583345065, =0.7.0-next.2011dfb2, =0.8.0-next.01993d09, =0.3.12, =0.13.0-next.0860ab1b, =0.7.0-next.2011dfb2, =0.17.0-next.01394fbb, =0.0.17, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0.19 and more Source cves: CVE-2021-41038 Source advisory:...

CVE-2021-41038

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage...

CVE-2021-41038: Improper Verification of Source of a Communication Channel

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage...

PT-2021-23059

Name of the Vulnerable Software and Affected Versions @theia/plugin-ext component of Eclipse Theia versions prior to 1.18.0 Description The issue allows Webview contents to be hijacked via the postMessage function. Recommendations For versions prior to 1.18.0, update to version 1.18.0 or later to...

Cross-site Scripting (XSS)

@theia/plugin-ext is vulnerable to cross-site scripting. An attacker is able to exploit the vulnerability by injecting malicious script into the system via the hostMessaging function. The vulnerability exists due to the lack of origin or parent check...

@theia/debug (>=1.1.0-next.14531578, <=1.8.0-next.fea40a2c), @theia/plugin-dev (>=1.1.0-next.14531578, <=1.8.0-next.fea40a2c) +4 more potentially affected by CVE-2021-28161 via @theia/console (>=1.1.0-next.14531578, <=1.8.0-next.fea40a2c)

@theia/console NPM version =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.8.0-next.fea40a2c Source cves: CVE-2021-28161 Source advisory: GHSA-CWG9-C9CR-P5FQ...

@theia/debug (>=1.1.0-next.14531578, <=1.8.0-next.fea40a2c), @theia/plugin-dev (>=1.1.0-next.14531578, <=1.8.0-next.fea40a2c) +4 more potentially affected by CVE-2021-28161 via @theia/console (>=1.1.0-next.14531578, <=1.8.0-next.fea40a2c)

@theia/console NPM version =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.8.0-next.fea40a2c Source cves: CVE-2021-28161 Source advisory: OSV:GHSA-CWG9-C9CR-P5FQ...

@theia/plantuml (>=0.1.2, <=0.1.7), @theia/plugin-dev (>=0.9.0-next.d57c6a91, <=0.13.0-next.fb398d67) +6 more potentially affected by CVE-2019-17636 via @theia/mini-browser (>=0.3.19, <=0.16.0-next.f114ded2)

@theia/mini-browser NPM version =0.3.19, =0.1.2, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.13.0-next.0860ab1b, =0.3.14, =0.0.4, =0.0.33 - coffee-workflow-analyzer 1.0.1 Source cves: CVE-2019-17636 Source advisory: OSV:GHSA-F7VX-J8MP-3H2X...

@theia/plantuml (>=0.1.2, <=0.1.7), @theia/plugin-dev (>=0.9.0-next.d57c6a91, <=0.13.0-next.fb398d67) +6 more potentially affected by CVE-2019-17636 via @theia/mini-browser (>=0.3.19, <=0.16.0-next.f114ded2)

@theia/mini-browser NPM version =0.3.19, =0.1.2, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.9.0-next.d57c6a91, =0.13.0-next.0860ab1b, =0.3.14, =0.0.4, =0.0.33 - coffee-workflow-analyzer 1.0.1 Source cves: CVE-2019-17636 Source advisory: GHSA-F7VX-J8MP-3H2X...