What is the CVSS score of CVE-2026-46580?

CVE-2026-46580 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-46580?

24 hours: Restrict users from opening repositories from untrusted sources and disable AI chat features if not operationally critical. 7 days: Audit all Eclipse Theia deployments to determine versions in use; implement file scanning for suspicious .prompts/*.prompttemplate files in workspace directories. 30 days: Work with vendor to track patch availability; develop and test upgrade procedures for rapid deployment when patched versions are released.

Eclipse Theia CVE-2026-46580

Q: Which versions of Eclipse Theia are affected by CVE-2026-46580?

Eclipse Theia versions prior to 1.71.0 contain an indirect prompt injection vulnerability that allows attackers to hijack AI system prompts through malicious repository files, potentially enabling…. A patch is available.

EUVD-2026-37899 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-06-18 eclipse

GHSA-m973-pr9r-hp2w

Code Injection Eclipse Theia Eclipse Foundation

8.4

CVSS 4.0 · Vendor: eclipse

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Publish malicious repository with .prompts template
Delivery

Victim clones and opens workspace in Theia
Exploit

Theia auto-loads .prompttemplate as system prompt
Execution

Victim invokes AI chat agent
Persist

Hijacked prompt triggers Markdown image fetch or task execution
Impact

Secrets exfiltrated or commands run on developer host

Vulnerability Assessment

Weakness	CWE CWE-829 OWASP Top 10:2025 A08:2025 - Software or Data Integrity Failures ASVS 5.0 V15 - Secure Coding and Architecture Trusted source inclusion only
Exploitation Conditions	Exploitation requires the victim to open an attacker-supplied workspace containing files at the path .prompts/*.prompttemplate in a Theia version prior to 1.71.0, with the AI agent / AI chat feature enabled and used after the workspace is opened. The CVSS UI:A and AV:L metrics confirm that no network-reachable service is exposed - the attacker must deliver the malicious repository (clone, zip, fork, etc.) and the victim must open it. Realized impact (data exfiltration or command execution) further depends on the victim invoking the AI chat after opening the workspace and on the IDE being permitted to render remote Markdown images or execute task definitions, which are default-on AI/IDE behaviors rather than special configuration.
Impact	The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) with 8.4 severity reflects high vulnerable-system C/I/A impact gated by user interaction - specifically, the victim must open the malicious workspace, which is the normal operating mode for an IDE and therefore a realistic precondition. There is no CISA KEV listing, no EPSS score provided, and no public exploit identified at time of analysis, so this is not an in-the-wild incident, but the conceptual barrier is low: any developer who clones and opens an untrusted repository (a routine review/triage workflow) becomes exposed. The AV:L choice is consistent with the attack landing through a workspace file rather than the network, and the lack of subsequent-system impact (SC:N/SI:N/SA:N) is debatable since attacker-controlled command execution and outbound Markdown image fetches can clearly reach beyond the IDE process - defenders should treat this as a developer-workstation compromise primitive, not just an IDE bug.
Exploit ScenarioDerived	An attacker publishes an attractive-looking repository (for example, a library fix, a CTF challenge, or a job-interview take-home) that contains a .prompts/system.prompttemplate file. When a developer using a vulnerable Theia-based IDE clones and opens the project, Theia silently loads the template and replaces the AI agent's system instructions with attacker-controlled directives that, on the next AI chat interaction, either render a Markdown image whose URL embeds workspace secrets or invoke a malicious task definition to execute commands on the developer's host.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 18, 2026

Indirect prompt injection in Eclipse Theia before 1.71.0 allows a malicious repository to automatically override the AI agent's system prompts when a victim opens the workspace, by placing files under .prompts/*.prompttemplate that Theia auto-loads. Combined with built-in AI chat features, the hijacked prompt can chain to data exfiltration via Markdown image rendering or arbitrary command execution via task definitions. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

RemediationAI

Vendor-released patch: Eclipse Theia 1.71.0 - upgrade to 1.71.0 or later as the primary fix, per the Eclipse advisory at https://gitlab.eclipse.org/security/cve-assignment/-/work_items/114. Until upgrade, treat any cloned repository as potentially hostile: before opening an untrusted workspace, inspect or delete any .prompts/ directory and *.prompttemplate files, and disable the AI agent / AI chat features for that workspace (this removes the AI-assisted workflow but eliminates the injection sink). Additional compensating controls include opening untrusted code in a sandboxed container or VM so that task-definition command execution and Markdown image fetches cannot reach developer credentials or internal networks, and blocking outbound network egress from the IDE host to prevent Markdown-image data exfiltration (at the cost of breaking other IDE features that fetch remote assets).

Affected VersionsENISA

Eclipse Theia 0 <1.71.0

Affected Packages

npm @theia/ai-chat fix: 1.71.0

npm @theia/ai-chat-ui fix: 1.71.0

npm @theia/ai-claude-code fix: 1.71.0

npm @theia/ai-code-completion fix: 1.71.0

npm @theia/ai-core fix: 1.71.0

npm @theia/ai-editor fix: 1.71.0

euvd eclipse_theia fix: 1.71.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 7 packages in npm, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Eclipse Theia is an open-source IDE framework (the basis for several commercial IDE products) that integrates an AI agent with configurable system prompts. The flaw maps to CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): workspace-scoped files matching the glob .prompts/*.prompttemplate were treated as trusted prompt-engineering material and merged into or replaced the agent's system instructions without a trust boundary distinguishing workspace content from IDE configuration. Because Theia's AI chat surface can also render Markdown (including remote images) and invoke workspace task definitions, an attacker-controlled system prompt becomes a pivot into the IDE's own privileged side-effect channels. The single CPE cpe:2.3:a:eclipse_foundation:eclipse_theia:*:*:*:*:*:*:*:* covers the Theia application across versions prior to 1.71.0.

Know when Eclipse Theia gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (eclipse) PRIMARY 8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

vuln.today AI 8.6 HIGH

Attack lands via a local workspace file (AV:L), no privileges needed (PR:N), victim must open the workspace (UI:R); attacker-controlled prompt pivots to task-execution and exfiltration outside the IDE process, justifying S:C and full C/I/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

Active

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Jun 18, 2026 - 17:02 EUVD

DescriptionCVE.org

In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing prompt template files that, when the workspace was opened in Theia, replaced the AI's system instructions with attacker-controlled content (indirect prompt injection). Combined with other AI chat features available in untrusted workspaces, this enabled attack chains leading to data exfiltration via Markdown image rendering or arbitrary command execution via task definitions.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

8 npm packages depend on @theia/ai-chat (7 direct, 1 indirect)
7 npm packages depend on @theia/ai-chat-ui (7 direct, 0 indirect)
27 npm packages depend on @theia/ai-core (21 direct, 6 indirect)

Ecosystem-wide dependent count for version 1.71.0 and other introduced versions.

Executive ViewAI

Why It Matters

Eclipse Theia versions prior to 1.71.0 contain an indirect prompt injection vulnerability that allows attackers to hijack AI system prompts through malicious repository files, potentially enabling data exfiltration or arbitrary command execution when developers open affected workspaces. While no confirmed active exploitation has been identified, the vulnerability poses significant risk to development teams using Theia's AI chat capabilities to handle sensitive information.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: restrict repository access to trusted internal sources only; disable AI chat functionality if not required; implement pre-import scanning of repository files for suspicious .prompts/*.prompttemplate files; require security review of workspace configuration before opening repositories from new sources; deploy development environments in sandboxed or containerized systems to limit impact of arbitrary command execution.

Threat Intelligence Overview

EPSS Score

0.3%

Top 81% exploitable

Threat Intel

1 source

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Small

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +42

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.