eclipse

10 results · Feed

• Medium 6.7
  CVE-2026-22551

  [Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat

  In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an attacker could induce t…

  Eclipse Foundation Eclipse Theia eclipse @theia/ai-core Ubuntu npm
  Jun 18, 2026
• High 8.4
  CVE-2026-46580

  [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat

  In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing prom…

  Eclipse Foundation Eclipse Theia eclipse @theia/ai-chat Ubuntu npm
  Jun 18, 2026
• High 8.6
  CVE-2026-7412

  Eclipse BaSyx Java Server SDK vulnerable to Server-Side Request Forgery

  In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI of delegated requests. An unauthenticated remote attacker can exploit this design flaw to force the BaSyx server to e…

  Eclipse Foundation Eclipse BaSyx eclipse org.eclipse.basyx:basyx.sdk Ubuntu Maven
  May 5, 2026
• High 8.7
  CVE-2026-6918

  In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte …

  Eclipse Foundation Eclipse OpenJ9 eclipse Ubuntu
  May 5, 2026
• Low 2.8
  CVE-2023-6194

  In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document ty…

  Eclipse Foundation Eclipse Memory Analyzer (tools.mat) eclipse Ubuntu
  Dec 11, 2023
• Medium 5.0
  CVE-2023-4218

  XXE in eclipse.platform / Eclipse IDE

  In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign reposi…

  Eclipse Foundation org.eclipse.pde org.eclipse.core.runtime Eclipse IDE Ubuntu Maven
  Nov 9, 2023
• Unscored —
  CVE-2021-41041

  In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification …

  The Eclipse Foundation Eclipse OpenJ9 eclipse Ubuntu
  Apr 27, 2022
• Unscored —
  CVE-2020-27225

  In versions 4.18 and earlier of the Eclipse Platform, the Help Subsystem does not authenticate active help requests to …

  The Eclipse Foundation Eclipse Platform eclipse Ubuntu
  Mar 9, 2021
• Medium 4.8
  CVE-2020-27218

  Buffer not correctly recycled in Gzip Request inflation

  In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacke…

  The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-server Debian Ubuntu Maven
  Nov 28, 2020
• Unscored —
  CVE-2013-0464

  Multiple cross-site scripting (XSS) vulnerabilities in IBM Eclipse Help System (IEHS) 3.4.3 and 3.6.2, as used in IBM S…

  eclipse Ubuntu
  Jun 3, 2013