Eclipse Theia CVE-2026-82217

Exploitation requires Eclipse Theia 1.73.0-1.74.x to be running with AI Agent Mode active and the victim to be engaged in an active Agent Mode session at the time the malicious content is processed. The vulnerability exists specifically in the writeFileContent, suggestFileContent, and associated replacement and state helper tools - non-Agent AI chat interactions that do not invoke these tools are not affected. The indirect prompt injection vector requires the victim to load attacker-influenced content into the agent's context, such as opening a repository with adversarial instructions embedded in files, fetching a crafted external resource, or processing third-party documentation. The CVSS vector specifies PR:N (no attacker authentication required against the Theia instance) and UI:R (the user must actively engage Agent Mode). Key limiting factors: the attack depends on successful indirect prompt injection, which is constrained by model instruction-following behavior and system prompt hardening; exploitation is further bounded by the backend OS user's privilege level - a least-privilege service account without SSH directory write access substantially reduces worst-case impact.

The official CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a scenario where an external attacker influences model path selection through indirect prompt injection, requiring only that the victim use Agent Mode. However, AC:L may overstate practical exploitability: successful exploitation requires Agent Mode to be active AND a prompt injection payload that survives the model's instruction filtering, which introduces real-world friction beyond what AC:L captures - AC:H is arguably more precise. No EPSS score was provided in the input intelligence, so exploitation probability is inferred rather than measured. This CVE is absent from the CISA KEV catalog, confirming no known active exploitation at time of analysis. No public proof-of-concept code has been identified. Despite the moderate real-world probability, the worst-case impact - silent write to ~/.ssh/authorized_keys yielding backend SSH access - is severe and warrants prompt patching wherever Theia runs in a networked or multi-user environment with AI features enabled.

An attacker embeds adversarial prompt injection instructions inside a file or repository resource that a developer loads into Theia's AI Agent Mode context - for example, a crafted README.md, a malicious code comment, or a fetched web page. The injected instruction directs the LLM to invoke writeFileContent with a path of ~/.ssh/authorized_keys and an attacker-controlled SSH public key as content. Because Agent Mode applies the write without a confirmation dialog, the key is written silently, and the attacker subsequently obtains SSH access to the backend host under the Theia backend OS user's account. No public proof-of-concept for this specific CVE has been identified at time of analysis.