EUVD-2026-41529Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-reachable unauthenticated (PR:N) cross-site WebSocket hijack yielding OS command execution (C/I/A:H), but requires the victim to visit a malicious page, so UI:R and scope unchanged.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
2DescriptionCVE.org
In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level authentication.
WebSocket origin validation in @theia/core is fail-open: connections are accepted when the Origin header is missing or when no THEIA_HOSTS allowlist is configured (the default). The Socket.IO integration additionally replaces the real Origin header with a client-supplied fix-origin header that an attacker can control or omit.
As a result, a foreign-origin web page visited by a user with a running Theia instance can open the /services WebSocket namespace, invoke terminal creation, attach to the resulting terminal data channel, execute arbitrary OS commands, and read their output. This affects both local developer setups (drive-by attack) and hosted or tunneled deployments without strong external authentication.
A fix is in development that enforces same-origin validation by default, removes trust in the fix-origin header, gates HTTP and WebSocket access on a SameSite=Strict; HttpOnly connection-token cookie, and sanitizes shell terminal creation options.
AnalysisAI
Cross-site WebSocket hijacking in Eclipse Theia's browser backend (versions 1.8.1 and later) lets a foreign-origin web page reach the unauthenticated /services shell-terminal RPC namespace and execute arbitrary OS commands on the victim's host. The flaw stems from fail-open Origin validation in @theia/core combined with a client-controllable fix-origin header, so simply luring a developer running Theia to a malicious site yields remote code execution. There is no public exploit identified at time of analysis, and CVSS is rated 8.8 (High) driven by the user-interaction-only barrier.
Technical ContextAI
Eclipse Theia is a framework for building cloud and desktop IDEs (the foundation for products like Eclipse Che and various hosted developer workspaces), running a Node.js browser-backend that exposes JSON-RPC services to the frontend over Socket.IO/WebSocket. The affected endpoints (/services/shell-terminal and /services/terminals/:id) provide privileged pseudo-terminal creation and data streaming but carry no service-level authentication, relying instead on Origin checks. This is a textbook CWE-1385 (Missing Origin Validation in WebSockets / Cross-Site WebSocket Hijacking): browsers do not apply Same-Origin Policy or CORS preflight to WebSocket handshakes, so any origin can open a socket unless the server explicitly validates the Origin header. Theia's validation is fail-open - it accepts connections when Origin is absent or when no THEIA_HOSTS allowlist is set (the default) - and the Socket.IO layer worsens this by substituting the real Origin with an attacker-supplied fix-origin header. The single affected CPE is cpe:2.3:a:eclipse_foundation:eclipse_theia:*, covering all 1.8.1+ builds.
RemediationAI
No vendor-released patch identified at time of analysis - the advisory states a fix is in development that will enforce same-origin validation by default, remove trust in the fix-origin header, gate HTTP and WebSocket access on a SameSite=Strict; HttpOnly connection-token cookie, and sanitize shell terminal creation options; monitor GHSA-78g8-vm3p-97c6 (https://github.com/eclipse-theia/theia/security/advisories/GHSA-78g8-vm3p-97c6) for the patched release and upgrade as soon as it ships. Until then, set the THEIA_HOSTS environment variable to an explicit allowlist of expected hostnames to convert the fail-open Origin check into a deny-by-default control (trade-off: you must enumerate and maintain every legitimate host, and misconfiguration can lock out real users). Place Theia behind an authenticating reverse proxy or VPN so the /services WebSocket namespace is never reachable from an unauthenticated browser context, and for local developer setups bind Theia to localhost only and avoid browsing untrusted sites while an instance is running (trade-off: reverse-proxy auth adds operational overhead and does not by itself stop a same-machine drive-by unless it also enforces per-request tokens). Note that Origin allowlisting alone is weakened by the client-controllable fix-origin header, so combine it with network-level access restrictions rather than relying on it in isolation.
More in Eclipse Theia
View allPath traversal in Eclipse Theia 1.73.0-1.74.x AI Agent Mode allows arbitrary file writes outside the workspace with back
Server-side request forgery in Eclipse Theia (version 1.26.0 and later) lets a low-privileged user connected to the /ser
Remote code execution in Eclipse Theia 1.69.0 and earlier allows an attacker to execute arbitrary commands with the vict
Arbitrary command execution in Eclipse Theia versions prior to 1.69.0 allows a malicious repository to run host commands
Indirect prompt injection in Eclipse Theia before 1.71.0 allows a malicious repository to automatically override the AI
Indirect prompt injection in Eclipse Theia versions prior to 1.71.0 allows attackers who control a workspace's filesyste
Unauthenticated arbitrary file read in Eclipse Theia browser-mode deployments (versions ≤1.73.1) allows any network clie
Unconstrained Markdown image rendering in Eclipse Theia's AI chat component, in all versions prior to 1.71.0, enables si
Same weakness CWE-1385 – Missing Origin Validation in WebSockets
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today