Which versions of Eclipse Theia are affected by CVE-2026-44688?

Eclipse Theia prior to version 1.71.0 enables attackers to compromise developer environments through malicious workspace repositories.. A patch is available.

How to fix or mitigate CVE-2026-44688?

Within 24 hours: Identify all Eclipse Theia deployments and their current versions. Within 7 days: Upgrade all instances to Eclipse Theia 1.71.0 or later. Within 30 days: Audit for suspicious repository access during the unpatched period and implement developer controls restricting Theia usage to known-good repositories.

Eclipse Theia CVE-2026-44688

Q: What is the CVSS score of CVE-2026-44688?

CVE-2026-44688 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-37898 HIGH

Improper Neutralization of Input Used for LLM Prompting (CWE-1427)

2026-06-18 eclipse

GHSA-3jww-hxqj-wfq2

Code Injection Eclipse Theia Eclipse Foundation

8.4

CVSS 4.0 · Vendor: eclipse

Severity by source

Vendor (eclipse) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Attack content arrives via a locally opened workspace (AV:L), no attacker auth (PR:N), the developer must open the repo and engage the agent (UI:R); the agent acts beyond its prompt boundary, so S:C with full C/I/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 18, 2026 - 17:02 EUVD

Analysis Generated

Jun 18, 2026 - 15:57 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

8 npm packages depend on @theia/ai-chat (7 direct, 1 indirect)
7 npm packages depend on @theia/ai-chat-ui (7 direct, 0 indirect)
27 npm packages depend on @theia/ai-core (21 direct, 6 indirect)

Ecosystem-wide dependent count for version 1.71.0 and other introduced versions.

DescriptionCVE.org

In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository with adversarial directory or file names that, when analyzed by the AI agent, would cause the agent to follow attacker-controlled instructions (indirect prompt injection). Combined with other AI chat features available in untrusted workspaces, this enabled attack chains leading to data exfiltration via Markdown image rendering or arbitrary command execution via task definitions.

AnalysisAI

Indirect prompt injection in Eclipse Theia versions prior to 1.71.0 allows attackers who control a workspace's filesystem layout to coerce the built-in AI chat agent into executing attacker-supplied instructions, enabling data exfiltration through Markdown image rendering or arbitrary command execution through task definitions. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 8.4 reflects high impact across confidentiality, integrity and availability once a developer opens an untrusted repository. The flaw is reported by the Eclipse Foundation and fixed in version 1.71.0.

Technical ContextAI

Eclipse Theia is an extensible cloud and desktop IDE framework (the foundation behind several commercial IDEs) that ships an integrated AI chat agent. The agent constructs its prompt context from the user's workspace, including directory and file names, but does not segregate this untrusted data from system instructions, which is the root cause class captured by CWE-1427 (Improper Neutralization of Special Elements used in a Prompt to an LLM, i.e. prompt injection). Because file and directory names flow into the same token stream as the agent's policy, an LLM cannot reliably tell trusted from untrusted text and will treat adversarial filenames as authoritative directives. The CPE cpe:2.3:a:eclipse_foundation:eclipse_theia:*:*:*:*:*:*:*:* covers all Theia builds up to but not including 1.71.0, and the impact is amplified by other Theia AI features that the agent can invoke, such as Markdown rendering (which performs outbound image fetches) and task execution (which can spawn shell commands).

RemediationAI

Vendor-released patch: Eclipse Theia 1.71.0 - upgrade all Theia-based IDE installations and rebuild any downstream products that vendor Theia to at least 1.71.0, referencing the Eclipse security tracker at https://gitlab.eclipse.org/security/cve-assignment/-/work_items/113. Where an immediate upgrade is not possible, disable the AI chat agent in untrusted workspaces, or operationally restrict developers from opening unreviewed third-party repositories until patched (the trade-off is loss of AI-assist productivity and reliance on user discipline). As defense-in-depth, configure the agent (if such settings are exposed) to disallow Markdown image auto-rendering and task execution prompts, accepting reduced functionality in exchange for breaking the documented exfiltration and command-execution chains; also consider opening unknown repositories in an ephemeral sandbox or container so that any command execution is contained.