Eclipse Theia (Eclipse Foundation) - vulnerabilities (CVEs)
12 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-08-31. Vendor: Eclipse Foundation.
CVEs of Eclipse Theia
- CVE-2026-82217 - CVSS 8.8 (high), 2026-08-31: In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the…
- CVE-2026-19884 - CVSS 8.4 (high), 2026-08-14: In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first.…
- CVE-2026-61891 - CVSS 7.5 (high), 2026-08-05: In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT…
- CVE-2026-60009 - CVSS 8.8 (high), 2026-08-05: In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The…
- CVE-2026-12609 - CVSS 7.5 (high), 2026-08-05: In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint,…
- CVE-2026-14574 - CVSS 6.5 (medium), 2026-08-05: In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values…
- CVE-2026-10055 - CVSS 8.5 (high), 2026-07-03: In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard…
- CVE-2026-10054 - CVSS 8.8 (high), 2026-07-03: In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal,…
- CVE-2026-44691 - CVSS 8.8 (high), 2026-06-18: In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without…
- CVE-2026-22551 - CVSS 6.7 (medium), 2026-06-18: In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs…
- CVE-2026-46580 - CVSS 8.8 (high), 2026-06-18: In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or…
- CVE-2026-44688 - CVSS 8.8 (high), 2026-06-18: In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing…
