eclipse

3 results · Clear filters · Feed

• Medium 6.7
  CVE-2026-22551

  [Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat

  In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an attacker could induce t…

  Eclipse Foundation Eclipse Theia eclipse @theia/ai-core Ubuntu npm
  Jun 18, 2026
• Medium 5.0
  CVE-2023-4218

  XXE in eclipse.platform / Eclipse IDE

  In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign reposi…

  Eclipse Foundation org.eclipse.core.runtime Eclipse IDE org.eclipse.pde Ubuntu Maven
  Nov 9, 2023
• Medium 4.8
  CVE-2020-27218

  Buffer not correctly recycled in Gzip Request inflation

  In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacke…

  The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-server Debian Ubuntu Maven
  Nov 28, 2020