Which versions of Eclipse Theia are affected by CVE-2026-44691?

Eclipse Theia versions prior to 1.69.0 expose organizations to supply chain compromise when developers open potentially hostile repositories; the IDE will silently execute arbitrary code with full…. A patch is available.

How to fix or mitigate CVE-2026-44691?

Within 24 hours: Conduct an asset inventory to identify all Eclipse Theia installations with versions < 1.69.0. Within 7 days: Disable the AI chat feature or enforce tool confirmation requirements on affected instances; implement a policy requiring manual review of all workspace configuration files (.theia/tasks.json, .vscode/tasks.json) before opening new repositories. Within 30 days: Monitor Eclipse Theia advisories for patch availability and test the upgrade to version 1.69.0 or later in a controlled environment before organization-wide deployment.

Eclipse Theia CVE-2026-44691

Q: What is the CVSS score of CVE-2026-44691?

CVE-2026-44691 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-37901 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-06-18 eclipse

GHSA-g9jw-92q7-g7fj

RCE Eclipse Theia

8.4

CVSS 4.0 · Vendor: eclipse

Severity by source

Vendor (eclipse) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Malicious workspace must reach the local filesystem (AV:L) and the user must open it / run a task (UI:R); no auth needed (PR:N); arbitrary command execution as user gives full CIA impact within the user's scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 18, 2026 - 17:02 EUVD

Analysis Generated

Jun 18, 2026 - 15:56 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

8 npm packages depend on @theia/debug (4 direct, 4 indirect)
9 npm packages depend on @theia/task (3 direct, 6 indirect)
57 npm packages depend on @theia/workspace (35 direct, 22 indirect)

Ecosystem-wide dependent count for version 1.69.0 and other introduced versions.

DescriptionCVE.org

In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user's privileges. In combination with AI chat features and a workspace .theia/settings.json that disabled tool confirmation, this could be triggered automatically by sending a message in the AI chat.

AnalysisAI

Arbitrary command execution in Eclipse Theia versions prior to 1.69.0 allows a malicious repository to run host commands with the user's privileges when its workspace is opened, because custom task definitions in .theia/tasks.json or .vscode/tasks.json bypass the workspace trust gate. When the victim has also enabled AI chat with tool confirmation disabled via a workspace .theia/settings.json, the chain triggers automatically on the first chat message. No public exploit identified at time of analysis, but the attack pattern mirrors well-known VS Code workspace-trust bypass classes.

Technical ContextAI

Eclipse Theia is an open-source IDE framework (the basis for several commercial cloud and desktop IDEs) that reuses VS Code's task and settings model. Workspace trust is the security boundary intended to prevent untrusted repositories from auto-executing code via tasks, debug configs, or settings. The flaw is a CWE-829 (Inclusion of Functionality from an Untrusted Control Sphere): custom task contributions registered through the workspace's tasks.json were honored before trust was granted, and a workspace-scoped settings.json could pre-disable AI tool-call confirmation. CPE cpe:2.3:a:eclipse_foundation:eclipse_theia covers all Theia versions below 1.69.0.

RemediationAI

Vendor-released patch: Eclipse Theia 1.69.0 - upgrade to 1.69.0 or later, which enforces workspace trust before honoring custom task definitions from workspace files. Downstream products that embed Theia must rebuild against 1.69.0+; verify with the IDE vendor before assuming a fix. Until the upgrade is deployed, do not open untrusted repositories in Theia, and specifically avoid cloning repositories that contain a .theia/ or .vscode/ directory you have not reviewed; auditing tasks.json and settings.json before opening is a concrete pre-open check. Operators of Theia distributions that bundle AI chat should not ship a default configuration that disables tool-call confirmation, and users should re-enable AI tool confirmation in user-scope settings so a workspace-scope override cannot silently suppress it. Refer to https://gitlab.eclipse.org/security/cve-assignment/-/work_items/116 for the vendor advisory.