Is there a patch available for CVE-2026-22551?

Yes, a patch is available for CVE-2026-22551. Update the affected software to the latest version immediately.

Eclipse Theia CVE-2026-22551

Q: What is the CVSS score of CVE-2026-22551?

CVE-2026-22551 has a CVSS 4.0 base score of 6.7 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-37900 MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-06-18 eclipse

GHSA-qwjm-9c66-w4q4

Information Disclosure Eclipse Theia Eclipse Foundation

6.7

CVSS 4.0 · Vendor: eclipse

Severity by source

Vendor (eclipse) PRIMARY

6.7 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

AV:L and UI:R reflect workspace-delivery and mandatory active AI chat interaction; AC:H captures prompt injection success uncertainty beyond attacker control.

3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 18, 2026 - 17:02 EUVD

Analysis Generated

Jun 18, 2026 - 16:06 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

8 npm packages depend on @theia/ai-chat (7 direct, 1 indirect)
7 npm packages depend on @theia/ai-chat-ui (7 direct, 0 indirect)
27 npm packages depend on @theia/ai-core (21 direct, 6 indirect)

Ecosystem-wide dependent count for version 1.71.0 and other introduced versions.

DescriptionCVE.org

In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an attacker could induce the AI agent to construct image URLs encoding sensitive information from the workspace or conversation context, exfiltrating it to attacker-controlled servers. The workspace trust enforcement introduced in v1.71.0 mitigates the documented attack chain by disabling AI features in untrusted workspaces.

AnalysisAI

Unconstrained Markdown image rendering in Eclipse Theia's AI chat component, in all versions prior to 1.71.0, enables silent data exfiltration when combined with prompt injection via a malicious workspace. An attacker who delivers a crafted workspace can inject instructions into the AI agent's context, causing it to construct Markdown image tags whose URLs encode sensitive workspace or conversation data; when the IDE renders these images, it issues HTTP GET requests transmitting that data to an attacker-controlled server. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the local-access, active-user-interaction model (CVSS 4.0: 6.7, AV:L/UI:A) correctly reflects that this is a targeted, workspace-delivery attack rather than a remote, unauthenticated threat.

Technical ContextAI

Eclipse Theia (CPE: cpe:2.3:a:eclipse_foundation:eclipse_theia:*:*:*:*:*:*:*:*) is an open-source cloud and desktop IDE framework with integrated AI chat capabilities. The root weakness is CWE-201 (Insertion of Sensitive Information Into Sent Data): the IDE's Markdown renderer evaluates image syntax (e.g., !alt) sourced from AI-generated responses without applying URL allowlisting, blocklisting, or rendering sandboxing, causing the IDE process to issue outbound HTTP requests to arbitrary attacker-specified endpoints. The secondary enabling factor is prompt injection susceptibility: because workspace files (README, code comments, configuration) are included in AI context, a malicious workspace author can embed natural-language instructions that steer the AI model into generating attacker-chosen image URLs populated with context-derived sensitive data. The two weaknesses are individually low-severity but compose into a meaningful exfiltration channel.

RemediationAI

The primary fix is to upgrade Eclipse Theia to version 1.71.0 or later, which introduces workspace trust enforcement that disables AI features for workspaces not explicitly marked as trusted, eliminating the documented attack chain. The Eclipse Foundation advisory is at https://gitlab.eclipse.org/security/cve-assignment/-/work_items/115. For environments that cannot immediately upgrade, the most effective compensating control is to disable the AI chat feature entirely in instances where workspace provenance cannot be verified, accepting the loss of AI-assisted development capabilities as a trade-off. Alternatively, enforcing outbound network policies on the IDE process to block HTTP requests to non-allowlisted domains would prevent successful exfiltration even if prompt injection succeeds, though it would not prevent the injection attempt itself and may interfere with legitimate AI service connectivity. Establishing a policy against opening untrusted or externally sourced workspaces in AI-enabled Theia instances is a low-friction organizational control until the patch can be deployed.