Skip to contentThe Eclipse Foundation Eclipse Theia vulnerabilities
- eclipse foundation theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change...CVE-2026-822178.8 High
- eclipse foundation theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control...CVE-2026-198848.4 High
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes...CVE-2026-618917.5 High
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST...CVE-2026-600098.8 High
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend...CVE-2026-126097.5 High
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge`...CVE-2026-145745.7 Medium
- eclipse foundation theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the…CVE-2026-100558.5 High
- eclipse foundation theia, the eclipse foundation eclipse theia +1 moreIn affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level au…CVE-2026-100548.8 High
- eclipse theia, the eclipse foundation eclipse theia +1 more[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task DefinitionsCVE-2026-44691Fix available8.4 High
- eclipse theia, the eclipse foundation eclipse theia +1 more[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI ChatCVE-2026-22551Fix available6.7 Medium
- eclipse theia, the eclipse foundation eclipse theia +1 more[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI ChatCVE-2026-46580Fix available8.4 High
- eclipse theia, the eclipse foundation eclipse theia +1 more[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI ChatCVE-2026-44688Fix available8.4 High
- eclipse theia, the eclipse foundation eclipse theia +1 moreIn Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote...CVE-2021-344369.8 Critical
- eclipse theia, the eclipse foundation eclipse theia +1 moreRemote code execution in Eclipse TheiaCVE-2021-34435Fix available8.8 High
- eclipse theia, the eclipse foundation eclipse theia +1 moreCommand Injection in @theia/messagesCVE-2021-28162Fix available6.1 Medium
- eclipse theia, the eclipse foundation eclipse theia +1 moreImproper Neutralization of Input in Theia consoleCVE-2021-28161Fix available6.1 Medium
- eclipse theia, the eclipse foundation eclipse theia +1 moreCross-site Scripting (XSS) in Eclipse TheiaCVE-2020-27224Fix available9.6 Critical
- eclipse theia, the eclipse foundation eclipse theia +1 moreInsufficient Verification of Data Authenticity in Eclipse TheiaCVE-2019-17636Fix available8.1 High