CVE-2021-28162: Eclipse Theia

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.

Affected products

• Eclipse Theia: up to and including 0.16.0

Published 2021-03-12. Last modified 2026-06-17.