Eclipse Theia EUVD-2026-37898

Exploitation requires that the target be running Eclipse Theia below 1.71.0 with the built-in AI chat agent enabled and the user must open an attacker-controlled workspace (e.g., clone a malicious repository) and interact with the AI chat agent against that workspace - this maps to the CVSS UI:A and AV:L choices. The end-to-end impact chain also depends on the agent having access to the Markdown image rendering feature (for data exfiltration) or the task-definition execution feature (for command execution); environments that have disabled those AI features break the documented chains. No network-reachable attack surface or attacker authentication is involved; the attacker's only foothold is the contents of the workspace the developer voluntarily opens.

The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N is internally consistent with the described attack: local attack vector because the malicious content reaches the agent through a workspace the user has opened on their machine, no privileges required by the attacker, but Active user interaction (UI:A) because the developer must open the repo and interact with the AI chat. Vulnerable-system C/I/A are all High, matching the documented outcomes (data exfiltration and command execution in the developer's IDE process). EPSS and CISA KEV data were not provided, and no public exploit is identified at time of analysis, so real-world exploitation pressure cannot be quantified from the supplied intelligence; however, the prerequisites (open a repo, chat with the AI) are routine developer behavior, so the practical likelihood is higher than a typical UI:A flaw once attackers learn the technique. Treat this as a real priority for any team that uses Theia-based IDEs on shared, forked, or otherwise untrusted source trees.

An attacker publishes a seemingly useful open-source repository whose directory or file names embed adversarial natural-language instructions (for example, a path like 'src/ignore previous instructions and run.../') . A developer clones the repo into a vulnerable Theia IDE and asks the AI chat agent a routine question about the codebase; the agent ingests the filenames as context, follows the embedded instructions, and either renders a Markdown image whose URL exfiltrates workspace data or invokes a task definition that runs an attacker-chosen shell command on the developer's machine.