EUVD-2026-58685
GHSA-4g73-gqqh-rfjc
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector because exploitation triggers only when a local folder is opened; user interaction required; no attacker privileges needed; full CIA impact on the victim's session with no scope change.
Primary rating from Vendor (eclipse).
CVSS VectorVendor: eclipse
Lifecycle Timeline
4DescriptionCVE.org
In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension and the builtin VS Code git extension run git commands such as git status as soon as a repository is detected. Since git honors repository-local configuration, a folder containing an attacker-controlled .git/config with core.fsmonitor (or a comparable hook-like setting) causes the configured command to be executed. The configuration can be delivered by burying a bare repository inside a regular repository (OVE-20210718-0001), so cloning an attacker-supplied repository and opening it in a Theia-based application is sufficient to execute arbitrary commands with the privileges of the user, without any confirmation prompt.
As of 1.70.0, plugins that declare capabilities.untrustedWorkspaces.supported: false, which includes the builtin git extension, are no longer loaded or activated in an untrusted workspace, and the deprecated @theia/git extension has been removed, so no git command is executed against an untrusted folder.
AnalysisAI
Remote code execution in Eclipse Theia 1.69.0 and earlier allows an attacker to execute arbitrary commands with the victim's user privileges by embedding a malicious git repository configuration inside a cloned repository. Any Theia-based IDE or application including the @theia/git extension or the bundled VS Code git extension is affected, because both automatically invoke git commands such as git status upon folder open without first presenting a workspace trust prompt. This vendor-confirmed issue is fixed in version 1.70.0 via workspace trust enforcement; no public exploit code has been identified at time of analysis and it does not appear in the CISA KEV catalog.
Technical ContextAI
Eclipse Theia is an open-source cloud and desktop IDE framework (CPE: cpe:2.3:a:eclipse_foundation:eclipse_theia:*:*:*:*:*:*:*:*) that underpins products such as the Eclipse Theia IDE and Eclipse Che. The root cause is CWE-829 (Inclusion of Functionality from Untrusted Control Sphere): git respects repository-local configuration in .git/config, which may specify hook-like settings such as core.fsmonitor or core.hooksPath that cause git to execute arbitrary external commands when git operations are performed. Theia's @theia/git extension and the bundled VS Code git extension both invoke git status and related commands immediately upon detecting a git repository in an opened folder - prior to any workspace trust prompt - so the .git/config entries execute in the user's context. The attack delivery technique, catalogued as OVE-20210718-0001, nests a bare repository inside a standard repository, meaning that a standard git clone of an attacker-controlled URL silently includes the malicious configuration without any visible anomaly. The fix in 1.70.0 enforces workspace trust: plugins declaring capabilities.untrustedWorkspaces.supported: false, including the builtin git extension, are no longer loaded in untrusted workspaces, and the deprecated @theia/git extension has been removed entirely.
RemediationAI
The primary and definitive remediation is upgrading Eclipse Theia to version 1.70.0 or later, which introduces workspace trust enforcement that prevents the builtin git extension and any other plugin declaring capabilities.untrustedWorkspaces.supported: false from loading in untrusted workspaces; the deprecated @theia/git extension is also removed in this release. The upstream changes are available at https://github.com/eclipse-theia/theia/pull/16809, https://github.com/eclipse-theia/theia/pull/17098, and https://github.com/eclipse-theia/theia/pull/17148. For organizations unable to immediately upgrade, the most targeted compensating control is to disable or uninstall the @theia/git extension in affected deployments, which eliminates the git command execution path at the cost of removing all source control integration. Alternatively, enforcing organizational policy that prohibits opening untrusted or externally-sourced repositories in Theia-based IDEs reduces exposure without changing the software, though this relies on user discipline and is not a technical control. There is no known lightweight workaround that preserves full git integration while preventing exploitation on pre-1.70.0 versions.
More in Eclipse Theia
View allPath traversal in Eclipse Theia 1.73.0-1.74.x AI Agent Mode allows arbitrary file writes outside the workspace with back
Cross-site WebSocket hijacking in Eclipse Theia's browser backend (versions 1.8.1 and later) lets a foreign-origin web p
Server-side request forgery in Eclipse Theia (version 1.26.0 and later) lets a low-privileged user connected to the /ser
Arbitrary command execution in Eclipse Theia versions prior to 1.69.0 allows a malicious repository to run host commands
Indirect prompt injection in Eclipse Theia before 1.71.0 allows a malicious repository to automatically override the AI
Indirect prompt injection in Eclipse Theia versions prior to 1.71.0 allows attackers who control a workspace's filesyste
Unauthenticated arbitrary file read in Eclipse Theia browser-mode deployments (versions ≤1.73.1) allows any network clie
Unconstrained Markdown image rendering in Eclipse Theia's AI chat component, in all versions prior to 1.71.0, enables si
Share
External POC / Exploit Code
Leaving vuln.today