CVE-2021-34436

—

CVSS 3.1

9.8 critical

EPSS

2%p82

Published

Sep 2, 2021 (Sep 2, 2021)

Modified

Jun 17, 2026

Description

In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to LemMinX) in order to provide language support for XML. This is installed by default.

Vendors: eclipse
Products: theia
Weakness: CWE-22, CWE-611
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.2%)

In the news0 stories

No ingested article mentions this CVE yet.