EUVD-2026-68519
GHSA-2qmg-qr8r-hr5c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AC:H reflects the practical requirement for successful indirect prompt injection steering model output to a crafted path; all other metrics align with the provided vector.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
4DescriptionCVE.org
In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replacement and state helpers) resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc, an absolute path, or a ~-expanded path could therefore write or delete files outside the workspace with the privileges of the Theia backend OS user. Because the path argument is influenced by model output, it can be steered through indirect prompt injection, and in Agent Mode writes are applied without a confirmation dialog. Writing to a host-executed file such as a shell startup file or ~/.ssh/authorized_keys can escalate to code execution on the backend.
AnalysisAI
Path traversal in Eclipse Theia 1.73.0-1.74.x AI Agent Mode allows arbitrary file writes outside the workspace with backend OS user privileges through model-supplied paths that bypass workspace-containment checks. The affected tools - writeFileContent, suggestFileContent, and associated replacement and state helpers - accept relative paths such as ../.bashrc, absolute paths, or tilde-expanded paths like ~/.ssh/authorized_keys without boundary validation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires Eclipse Theia 1.73.0-1.74.x to be running with AI Agent Mode active and the victim to be engaged in an active Agent Mode session at the time the malicious content is processed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a scenario where an external attacker influences model path selection through indirect prompt injection, requiring only that the victim use Agent Mode. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Eclipse Theia 1.75.0 or later, which incorporates the fix in commit 28da106c254 (https://github.com/eclipse-theia/theia/commit/28da106c254); this replaces the broken per-tool path handling with the unified resolveAccessiblePath method. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Eclipse Theia 1.73.0-1.74.x deployments and disable AI Agent Mode unless operationally critical; audit existing developer-loaded content for malicious prompts or injected payloads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Eclipse Theia
View allCross-site WebSocket hijacking in Eclipse Theia's browser backend (versions 1.8.1 and later) lets a foreign-origin web p
Server-side request forgery in Eclipse Theia (version 1.26.0 and later) lets a low-privileged user connected to the /ser
Remote code execution in Eclipse Theia 1.69.0 and earlier allows an attacker to execute arbitrary commands with the vict
Arbitrary command execution in Eclipse Theia versions prior to 1.69.0 allows a malicious repository to run host commands
Indirect prompt injection in Eclipse Theia before 1.71.0 allows a malicious repository to automatically override the AI
Indirect prompt injection in Eclipse Theia versions prior to 1.71.0 allows attackers who control a workspace's filesyste
Unauthenticated arbitrary file read in Eclipse Theia browser-mode deployments (versions ≤1.73.1) allows any network clie
Unconstrained Markdown image rendering in Eclipse Theia's AI chat component, in all versions prior to 1.71.0, enables si
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today