CVE-2021-34435: Exposure of Resource to Wrong Sphere

September 1, 2021 (updated October 27, 2022)

In Eclipse Theia to, the mini-browser extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file.

References

bugs.eclipse.org/bugs/show_bug.cgi?id=568018
nvd.nist.gov/vuln/detail/CVE-2021-34435

Code Behaviors & Features

Detect and mitigate CVE-2021-34435 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →