description: In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().
problem types: CWE-940: Improper Verification of Source of a Communication Channel
affected:
{
product: @theia/plugin-ext
vendor: The Eclipse Foundation
versions:
lessThan: 1.18.0, status: affected, version: unspecified, versionType: custom
}