theia-ide/theia-xml-extension · Security
In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote...
- GHSA ID
- GHSA-8gpx-73gc-wq7c
- CVE ID
- CVE-2021-34436
- Severity
- critical
- Published
- Updated
Description
In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to LemMinX) in order to provide language support for XML. This is installed by default.
CWEs
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-611 · Improper Restriction of XML External Entity Reference