Eclipse Theia CVE-2026-44691

Requires the victim to open an attacker-controlled workspace in Eclipse Theia <1.69.0 that contains a crafted .theia/tasks.json or .vscode/tasks.json defining a custom task; the user must perform an action that runs the task (UI:A in the CVSS 4.0 vector). The zero-click variant additionally requires that the workspace ships a .theia/settings.json disabling AI tool-call confirmation AND that the Theia build has AI chat features enabled AND that the victim sends at least one chat message. Authentication is not required (PR:N). Limiting factors: the attacker cannot reach a Theia instance over the network without first delivering a workspace to the victim's filesystem (AV:L), and Theia distributions that do not bundle AI chat are not exposed to the zero-click variant - they remain exposed to the standard task-on-open variant.

The vendor CVSS 4.0 score of 8.4 (AV:L/AC:L/PR:N/UI:A/VC:H/VI:H/VA:H) accurately reflects a high-impact but interaction-dependent flaw: code execution as the logged-in user, requiring the victim to clone and open a malicious workspace. EPSS and CISA KEV data were not provided, and no public exploit code is referenced, so the practical near-term risk is moderate rather than imminent - comparable to historical VS Code workspace-trust bypasses that were patched without mass exploitation. Risk rises sharply for developers who routinely open untrusted repositories (security researchers, code reviewers, OSS maintainers) and especially those running Theia-based AI assistants with tool confirmation suppressed, where exploitation becomes effectively zero-click after opening the workspace. Note that the vendor selected AV:L, implying the malicious workspace must reach the local filesystem; delivery via a cloned Git repo is trivially in scope, so the 'local' label should not be read as a meaningful defensive barrier.

An attacker publishes an attractive-looking repository (e.g., a CTF writeup, library fork, or job-interview take-home) containing a .theia/tasks.json with a malicious shell task and, optionally, a .theia/settings.json that disables AI tool confirmation. A developer clones the repo and opens it in Theia; either Theia auto-runs a default task or the attacker's social-engineering README prompts a benign-looking action that fires the task, executing commands as the user. If the victim then sends any message in the Theia AI chat, the suppressed-confirmation setting causes the model's tool calls to execute without prompt, giving the attacker a follow-on automatic trigger.