Which versions of Eclipse Theia are affected by CVE-2026-46580?

Eclipse Theia versions prior to 1.71.0 contain an indirect prompt injection vulnerability that allows attackers to hijack AI system prompts through malicious repository files, potentially enabling…. A patch is available.

How to fix or mitigate CVE-2026-46580?

24 hours: Restrict users from opening repositories from untrusted sources and disable AI chat features if not operationally critical. 7 days: Audit all Eclipse Theia deployments to determine versions in use; implement file scanning for suspicious .prompts/*.prompttemplate files in workspace directories. 30 days: Work with vendor to track patch availability; develop and test upgrade procedures for rapid deployment when patched versions are released.

Eclipse Theia CVE-2026-46580

Q: What is the CVSS score of CVE-2026-46580?

CVE-2026-46580 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-37899 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-06-18 eclipse

GHSA-m973-pr9r-hp2w

Code Injection Eclipse Theia

8.4

CVSS 4.0 · Vendor: eclipse

Severity by source

Vendor (eclipse) PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Attack lands via a local workspace file (AV:L), no privileges needed (PR:N), victim must open the workspace (UI:R); attacker-controlled prompt pivots to task-execution and exfiltration outside the IDE process, justifying S:C and full C/I/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 18, 2026 - 17:02 EUVD

Analysis Generated

Jun 18, 2026 - 15:56 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

8 npm packages depend on @theia/ai-chat (7 direct, 1 indirect)
7 npm packages depend on @theia/ai-chat-ui (7 direct, 0 indirect)
27 npm packages depend on @theia/ai-core (21 direct, 6 indirect)

Ecosystem-wide dependent count for version 1.71.0 and other introduced versions.

DescriptionCVE.org

In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing prompt template files that, when the workspace was opened in Theia, replaced the AI's system instructions with attacker-controlled content (indirect prompt injection). Combined with other AI chat features available in untrusted workspaces, this enabled attack chains leading to data exfiltration via Markdown image rendering or arbitrary command execution via task definitions.

AnalysisAI

Indirect prompt injection in Eclipse Theia before 1.71.0 allows a malicious repository to automatically override the AI agent's system prompts when a victim opens the workspace, by placing files under .prompts/*.prompttemplate that Theia auto-loads. Combined with built-in AI chat features, the hijacked prompt can chain to data exfiltration via Markdown image rendering or arbitrary command execution via task definitions. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Eclipse Theia is an open-source IDE framework (the basis for several commercial IDE products) that integrates an AI agent with configurable system prompts. The flaw maps to CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): workspace-scoped files matching the glob .prompts/*.prompttemplate were treated as trusted prompt-engineering material and merged into or replaced the agent's system instructions without a trust boundary distinguishing workspace content from IDE configuration. Because Theia's AI chat surface can also render Markdown (including remote images) and invoke workspace task definitions, an attacker-controlled system prompt becomes a pivot into the IDE's own privileged side-effect channels. The single CPE cpe:2.3:a:eclipse_foundation:eclipse_theia:*:*:*:*:*:*:*:* covers the Theia application across versions prior to 1.71.0.

RemediationAI

Vendor-released patch: Eclipse Theia 1.71.0 - upgrade to 1.71.0 or later as the primary fix, per the Eclipse advisory at https://gitlab.eclipse.org/security/cve-assignment/-/work_items/114. Until upgrade, treat any cloned repository as potentially hostile: before opening an untrusted workspace, inspect or delete any .prompts/ directory and *.prompttemplate files, and disable the AI agent / AI chat features for that workspace (this removes the AI-assisted workflow but eliminates the injection sink). Additional compensating controls include opening untrusted code in a sandboxed container or VM so that task-definition command execution and Markdown image fetches cannot reach developer credentials or internal networks, and blocking outbound network egress from the IDE host to prevent Markdown-image data exfiltration (at the cost of breaking other IDE features that fetch remote assets).