CVE-2021-34435

Published: Sep 1, 2021Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file..

Affected (1)

Products: Eclipse: Theia

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Eclipse Theia	From 0.3.9 to 1.8.1

Related CWEs

Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

Permissive Cross-domain Policy with Untrusted Domains

The product uses a cross-domain policy file that includes domains that should not be trusted.

References (2)

https://bugs.eclipse.org/bugs/show_bug.cgi?id=568018

Source: emo@eclipse.org

ExploitPatchVendor Advisory

https://bugs.eclipse.org/bugs/show_bug.cgi?id=568018

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchVendor Advisory

Timeline

No history available yet.