Skip to contentEclipse Foundation Theia vulnerabilities
- eclipse foundation theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change...CVE-2026-822178.8 High
- eclipse foundation theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control...CVE-2026-198848.4 High
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes...CVE-2026-618917.5 High
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST...CVE-2026-600098.8 High
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend...CVE-2026-126097.5 High
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge`...CVE-2026-145745.7 Medium
- eclipse foundation theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the…CVE-2026-100558.5 High
- eclipse foundation theia, the eclipse foundation eclipse theia +1 moreIn affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level au…CVE-2026-100548.8 High
- eclipse theia, the eclipse foundation eclipse theia +1 more[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task DefinitionsCVE-2026-44691Fix available8.4 High
- eclipse theia, the eclipse foundation eclipse theia +1 more[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI ChatCVE-2026-22551Fix available6.7 Medium
- eclipse theia, the eclipse foundation eclipse theia +1 more[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI ChatCVE-2026-46580Fix available8.4 High
- eclipse theia, the eclipse foundation eclipse theia +1 more[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI ChatCVE-2026-44688Fix available8.4 High
- eclipse theia website, eclipse foundation theia - website +1 moreIn the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview...CVE-2026-1699Public exploit10.0 Critical