CVE-2021-34435

In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file..

• CWE-942
• CWE-346

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=568018Exploit, Patch, Vendor Advisory
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=568018Exploit, Patch, Vendor Advisory

Published

Sep 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3443A NULL pointer dereference flaw was found in the way Jasper …5.5
• CVE-2021-34430Eclipse TinyDTLS through 0.9-rc1 relies on the rand function…7.5
• CVE-2021-34431In Eclipse Mosquitto version 1.6 to 2.0.10, if an authentica…6.5
• CVE-2021-34432In Eclipse Mosquitto versions 2.0.7 and earlier, the server …7.5
• CVE-2021-34433In Eclipse Californium version 2.0.0 to 2.6.4 and 3.0.0-M1 t…7.5
• CVE-2021-34434In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the …5.3
• CVE-2021-34436In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit t…9.8
• CVE-2021-34438Windows Font Driver Host Remote Code Execution Vulnerability7.8
• CVE-2021-34439Microsoft Windows Media Foundation Remote Code Execution Vul…7.8
• CVE-2021-3444The bpf verifier in the Linux kernel did not properly handle…7.8
• CVE-2021-34440GDI+ Information Disclosure Vulnerability5.5
• CVE-2021-34441Microsoft Windows Media Foundation Remote Code Execution Vul…7.8