Eclipse Foundation Vulnerabilities and Affected Products

Open in search

Vulnerabilities associated with Eclipse Theia.

Products

Clear product

Showing 10 vulnerabilities on this page for Eclipse Theia

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Eclipse Theia @theia/filesystem Unauthenticated Absolute Path Traversal Arbitrary File Read

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any allow-listed root. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in `@theia/core` re-issues the cookie and calls `next()` without…

CWE-200CWE-22CWE-306CWE-36Aug 5, 2026
CVSS7.5v3.1EPSS0.451%PoCs0SignalsSTIX

Eclipse Theia Unauthenticated Arbitrary File Write via POST /file-upload

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart `uri` field and calls `fs.move(tmp, target, { overwrite: true })` with no workspace confinement and no authentication. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in `@theia/core` re-issues the cookie …

CWE-22CWE-306CWE-352CWE-73Aug 5, 2026
CVSS8.8v3.1EPSS0.323%PoCs0SignalsSTIX

Eclipse Theia @theia/plugin-ext Path Traversal Arbitrary File Read

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded `../` sequences (`%2e%2e%2f`) that decode into the path parameter and escape the plugin directory, allowing arbitrary files…

CWE-22Aug 5, 2026
CVSS7.5v3.1EPSS0.409%PoCs0SignalsSTIX

Eclipse Theia Prototype Pollution via PreferenceUtils.merge

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values without rejecting prototype-related keys (`__proto__`, `constructor`, `prototype`). Because this function is invoked by `PreferenceServiceImpl.doResolve` for every preference resolution across scopes (default, user, workspace, folder), a crafted preference value in a workspace settings file (`.theia/settings.json` or `.vscode/settings.json`) ca…

CWE-1321Aug 5, 2026
CVSS5.7v4.0EPSS0.282%PoCs0SignalsSTIX

Eclipse Theia Server-Side Request Forgery via /services/request-service

In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller. Because the destination URL is neither validated nor allowlisted, a remote attacker with access to the Theia service connection can issue server-side HTTP requests to localhost or other backend-reachable hosts and read …

CWE-200CWE-918Jul 3, 2026
CVSS8.5v3.1EPSS0.297%PoCs0SignalsSTIX

Eclipse Theia Missing WebSocket Origin Validation and Authentication Bypass

In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when the Origin header is missing or when no THEIA_HOSTS allowlist is configured (the default). The Socket.IO integration additionally replaces the real Origin header with a client-supplied fix-origin…

CWE-1385CWE-306Jul 3, 2026
CVSS8.8v3.1EPSS0.159%PoCs0SignalsSTIX

[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions

In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user's privileges. In combination with AI chat features and a workspace .theia/settings.json that disabled tool confirmation, this could be triggered automatically by sending a mes…

CWE-829Jun 18, 2026
CVSS8.4v4.0EPSS0.408%PoCs0SignalsSTIX

[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat

In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an attacker could induce the AI agent to construct image URLs encoding sensitive information from the workspace or conversation context, exfiltrating it to attacker-controlled servers. The workspace trust enforcement introduced in v1.71.0 mitigates the documented att…

CWE-201CWE-829Jun 18, 2026
CVSS6.7v4.0EPSS0.312%PoCs0SignalsSTIX

[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat

In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing prompt template files that, when the workspace was opened in Theia, replaced the AI's system instructions with attacker-controlled content (indirect prompt injection). Combined with other AI chat features available in untrusted workspaces, this …

CWE-1427CWE-829Jun 18, 2026
CVSS8.4v4.0EPSS0.507%PoCs0SignalsSTIX

[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat

In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository with adversarial directory or file names that, when analyzed by the AI agent, would cause the agent to follow attacker-controlled instructions (indirect prompt injection). Combined with other AI chat features available in untrusted workspaces, this enabled attack…

CWE-1427CWE-829Jun 18, 2026
CVSS8.4v4.0EPSS0.507%PoCs0SignalsSTIX