{"action":"Upgrade @theia/preview to 1.3.0 or later.","affected":[{"fixed":"1.3.0","introduced":"0"}],"component":"@theia/preview","cve_ids":["CVE-2020-27224"],"ecosystem":"npm","epss":0.02593,"exploited":false,"fixed_versions":["1.3.0"],"ghsa_id":"GHSA-gcm9-cc3r-c6vj","id":"tcs_01M5KFRBQWYREMPW3N0D86RMKR","modified_at":"2023-11-08T04:03:21.439389Z","published_at":"2021-04-13T15:18:09Z","references":["https://osv.dev/vulnerability/GHSA-gcm9-cc3r-c6vj","https://nvd.nist.gov/vuln/detail/CVE-2020-27224","https://github.com/eclipse-theia/theia/issues/7954","https://github.com/eclipse-theia/theia/pull/7971","https://omespino.com/write-up-google-bug-bounty-xss-to-cloud-shell-instance-takeover-rce-as-root-5000-usd"],"severity":{"label":"critical","score":9.6},"sources":[{"source":"osv","source_id":"GHSA-gcm9-cc3r-c6vj","url":"https://osv.dev/vulnerability/GHSA-gcm9-cc3r-c6vj"}],"summary":"Cross-site Scripting (XSS) in Eclipse Theia"}