Eclipse Theia
Monthly
Path traversal in Eclipse Theia 1.73.0-1.74.x AI Agent Mode allows arbitrary file writes outside the workspace with backend OS user privileges through model-supplied paths that bypass workspace-containment checks. The affected tools - writeFileContent, suggestFileContent, and associated replacement and state helpers - accept relative paths such as ../.bashrc, absolute paths, or tilde-expanded paths like ~/.ssh/authorized_keys without boundary validation. Because path arguments derive from LLM output, an indirect prompt injection attack embedded in developer-loaded content can steer writes to host-executed files and escalate to backend code execution; Agent Mode applies writes silently with no confirmation dialog. No public exploit code or CISA KEV listing exists at time of analysis, though the prompt-injection attack surface is realistic in cloud IDE deployments.
Remote code execution in Eclipse Theia 1.69.0 and earlier allows an attacker to execute arbitrary commands with the victim's user privileges by embedding a malicious git repository configuration inside a cloned repository. Any Theia-based IDE or application including the @theia/git extension or the bundled VS Code git extension is affected, because both automatically invoke git commands such as git status upon folder open without first presenting a workspace trust prompt. This vendor-confirmed issue is fixed in version 1.70.0 via workspace trust enforcement; no public exploit code has been identified at time of analysis and it does not appear in the CISA KEV catalog.
Unauthenticated arbitrary file read in Eclipse Theia browser-mode deployments (versions ≤1.73.1) allows any network client to exfiltrate files accessible to the backend process, including paths outside the opened workspace such as SSH keys, cloud credential tokens, and system configuration files. The vulnerability combines two compounding flaws: the `@theia/filesystem` HTTP endpoints perform no workspace confinement when resolving client-supplied URIs to filesystem paths, and a middleware defect in `@theia/core` re-issues the session cookie and calls `next()` without validating the connection token on HTTP requests - token enforcement applies only to WebSocket upgrades, leaving all HTTP file endpoints fully exposed. Electron deployments are explicitly not affected via this path. No public exploit is identified at time of analysis.
Server-side request forgery in Eclipse Theia (version 1.26.0 and later) lets a low-privileged user connected to the /services messaging endpoint coerce the backend into fetching an attacker-supplied URL and returning the full response body, exposing localhost admin interfaces and cloud instance metadata that sit behind the browser network boundary. The flaw is exploitable by any client with access to the Theia service connection, making multi-tenant and publicly-reachable deployments the primary concern. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cross-site WebSocket hijacking in Eclipse Theia's browser backend (versions 1.8.1 and later) lets a foreign-origin web page reach the unauthenticated /services shell-terminal RPC namespace and execute arbitrary OS commands on the victim's host. The flaw stems from fail-open Origin validation in @theia/core combined with a client-controllable fix-origin header, so simply luring a developer running Theia to a malicious site yields remote code execution. There is no public exploit identified at time of analysis, and CVSS is rated 8.8 (High) driven by the user-interaction-only barrier.
Arbitrary command execution in Eclipse Theia versions prior to 1.69.0 allows a malicious repository to run host commands with the user's privileges when its workspace is opened, because custom task definitions in .theia/tasks.json or .vscode/tasks.json bypass the workspace trust gate. When the victim has also enabled AI chat with tool confirmation disabled via a workspace .theia/settings.json, the chain triggers automatically on the first chat message. No public exploit identified at time of analysis, but the attack pattern mirrors well-known VS Code workspace-trust bypass classes.
Unconstrained Markdown image rendering in Eclipse Theia's AI chat component, in all versions prior to 1.71.0, enables silent data exfiltration when combined with prompt injection via a malicious workspace. An attacker who delivers a crafted workspace can inject instructions into the AI agent's context, causing it to construct Markdown image tags whose URLs encode sensitive workspace or conversation data; when the IDE renders these images, it issues HTTP GET requests transmitting that data to an attacker-controlled server. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the local-access, active-user-interaction model (CVSS 4.0: 6.7, AV:L/UI:A) correctly reflects that this is a targeted, workspace-delivery attack rather than a remote, unauthenticated threat.
Indirect prompt injection in Eclipse Theia before 1.71.0 allows a malicious repository to automatically override the AI agent's system prompts when a victim opens the workspace, by placing files under .prompts/*.prompttemplate that Theia auto-loads. Combined with built-in AI chat features, the hijacked prompt can chain to data exfiltration via Markdown image rendering or arbitrary command execution via task definitions. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Indirect prompt injection in Eclipse Theia versions prior to 1.71.0 allows attackers who control a workspace's filesystem layout to coerce the built-in AI chat agent into executing attacker-supplied instructions, enabling data exfiltration through Markdown image rendering or arbitrary command execution through task definitions. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 8.4 reflects high impact across confidentiality, integrity and availability once a developer opens an untrusted repository. The flaw is reported by the Eclipse Foundation and fixed in version 1.71.0.
Path traversal in Eclipse Theia 1.73.0-1.74.x AI Agent Mode allows arbitrary file writes outside the workspace with backend OS user privileges through model-supplied paths that bypass workspace-containment checks. The affected tools - writeFileContent, suggestFileContent, and associated replacement and state helpers - accept relative paths such as ../.bashrc, absolute paths, or tilde-expanded paths like ~/.ssh/authorized_keys without boundary validation. Because path arguments derive from LLM output, an indirect prompt injection attack embedded in developer-loaded content can steer writes to host-executed files and escalate to backend code execution; Agent Mode applies writes silently with no confirmation dialog. No public exploit code or CISA KEV listing exists at time of analysis, though the prompt-injection attack surface is realistic in cloud IDE deployments.
Remote code execution in Eclipse Theia 1.69.0 and earlier allows an attacker to execute arbitrary commands with the victim's user privileges by embedding a malicious git repository configuration inside a cloned repository. Any Theia-based IDE or application including the @theia/git extension or the bundled VS Code git extension is affected, because both automatically invoke git commands such as git status upon folder open without first presenting a workspace trust prompt. This vendor-confirmed issue is fixed in version 1.70.0 via workspace trust enforcement; no public exploit code has been identified at time of analysis and it does not appear in the CISA KEV catalog.
Unauthenticated arbitrary file read in Eclipse Theia browser-mode deployments (versions ≤1.73.1) allows any network client to exfiltrate files accessible to the backend process, including paths outside the opened workspace such as SSH keys, cloud credential tokens, and system configuration files. The vulnerability combines two compounding flaws: the `@theia/filesystem` HTTP endpoints perform no workspace confinement when resolving client-supplied URIs to filesystem paths, and a middleware defect in `@theia/core` re-issues the session cookie and calls `next()` without validating the connection token on HTTP requests - token enforcement applies only to WebSocket upgrades, leaving all HTTP file endpoints fully exposed. Electron deployments are explicitly not affected via this path. No public exploit is identified at time of analysis.
Server-side request forgery in Eclipse Theia (version 1.26.0 and later) lets a low-privileged user connected to the /services messaging endpoint coerce the backend into fetching an attacker-supplied URL and returning the full response body, exposing localhost admin interfaces and cloud instance metadata that sit behind the browser network boundary. The flaw is exploitable by any client with access to the Theia service connection, making multi-tenant and publicly-reachable deployments the primary concern. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Cross-site WebSocket hijacking in Eclipse Theia's browser backend (versions 1.8.1 and later) lets a foreign-origin web page reach the unauthenticated /services shell-terminal RPC namespace and execute arbitrary OS commands on the victim's host. The flaw stems from fail-open Origin validation in @theia/core combined with a client-controllable fix-origin header, so simply luring a developer running Theia to a malicious site yields remote code execution. There is no public exploit identified at time of analysis, and CVSS is rated 8.8 (High) driven by the user-interaction-only barrier.
Arbitrary command execution in Eclipse Theia versions prior to 1.69.0 allows a malicious repository to run host commands with the user's privileges when its workspace is opened, because custom task definitions in .theia/tasks.json or .vscode/tasks.json bypass the workspace trust gate. When the victim has also enabled AI chat with tool confirmation disabled via a workspace .theia/settings.json, the chain triggers automatically on the first chat message. No public exploit identified at time of analysis, but the attack pattern mirrors well-known VS Code workspace-trust bypass classes.
Unconstrained Markdown image rendering in Eclipse Theia's AI chat component, in all versions prior to 1.71.0, enables silent data exfiltration when combined with prompt injection via a malicious workspace. An attacker who delivers a crafted workspace can inject instructions into the AI agent's context, causing it to construct Markdown image tags whose URLs encode sensitive workspace or conversation data; when the IDE renders these images, it issues HTTP GET requests transmitting that data to an attacker-controlled server. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the local-access, active-user-interaction model (CVSS 4.0: 6.7, AV:L/UI:A) correctly reflects that this is a targeted, workspace-delivery attack rather than a remote, unauthenticated threat.
Indirect prompt injection in Eclipse Theia before 1.71.0 allows a malicious repository to automatically override the AI agent's system prompts when a victim opens the workspace, by placing files under .prompts/*.prompttemplate that Theia auto-loads. Combined with built-in AI chat features, the hijacked prompt can chain to data exfiltration via Markdown image rendering or arbitrary command execution via task definitions. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Indirect prompt injection in Eclipse Theia versions prior to 1.71.0 allows attackers who control a workspace's filesystem layout to coerce the built-in AI chat agent into executing attacker-supplied instructions, enabling data exfiltration through Markdown image rendering or arbitrary command execution through task definitions. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 8.4 reflects high impact across confidentiality, integrity and availability once a developer opens an untrusted repository. The flaw is reported by the Eclipse Foundation and fixed in version 1.71.0.