Skip to content
OpenAdvisories

Product · Eclipse Foundation

Eclipse Theia

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 8.8
    CVE-2026-82217

    In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileConten…

    Eclipse Foundation Eclipse Theia
  • High 8.4
    CVE-2026-19884

    In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requir…

    Eclipse Foundation Eclipse Theia
  • High 7.5
    CVE-2026-61891

    In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoi…

    Eclipse Foundation Eclipse Theia
  • High 8.8
    CVE-2026-60009

    In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in ever…

    Eclipse Foundation Eclipse Theia
  • High 7.5
    CVE-2026-12609 Scanner template

    In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlu…

    Eclipse Foundation Eclipse Theia
  • High 8.5
    CVE-2026-10055

    In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL fro…

    Eclipse Foundation Eclipse Theia
  • High 8.8
    CVE-2026-10054

    In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSo…

    Eclipse Foundation Eclipse Theia
  • High 8.4
    CVE-2026-44691

    [Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions

    In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened…

    Eclipse Foundation Eclipse Theia @theia/task @theia/debug npm
  • High 8.4
    CVE-2026-46580

    [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat

    In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing prom…

    Eclipse Foundation Eclipse Theia eclipse @theia/ai-editor Ubuntu npm
  • High 8.4
    CVE-2026-44688

    [Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat

    In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository with adversarial direc…

    Eclipse Foundation Eclipse Theia @theia/ai-editor @theia/ai-chat-ui npm