Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
In Eclipse Theia versions up to and including, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.
Advisories for Npm/@Theia/Console package
2021