CVE-2021-28161: Eclipse Theia

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.

Affected products

• Eclipse Theia: up to and including 1.8.0

Published 2021-03-12. Last modified 2026-06-17.