<p>Upgrade <code>@theia/preview</code> to version 1.3.0 or higher.</p>

Cross-site Scripting (XSS) Affecting @theia/preview package, versions <1.3.0

Threat Intelligence

0.38% (74^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-JS-THEIAPREVIEW-1079037
published 25 Feb 2021
disclosed 25 Feb 2021
credit Casey Flynn

Report a new vulnerability Found a mistake?

Introduced: 25 Feb 2021

CVE-2020-27224 Open this link in a new tab CWE-94 Open this link in a new tab

How to fix?

Upgrade @theia/preview to version 1.3.0 or higher.

Overview

@theia/preview is a Theia - Preview Extension

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). The Markdown Preview (@theia/preview), can be exploited to execute arbitrary JavaScript code.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

Low
Privileges Required (PR)

Low
User Interaction (UI)

Required

Scope (S)

Unchanged

Confidentiality (C)

High
Integrity (I)

Low
Availability (A)

None