Prototype Pollution

Overview @theia/core is a the main extension for all Theia-based applications, and provides the main framework for all dependent extensions. Affected versions of this package are vulnerable to Prototype Pollution via the PreferenceUtils.merge function in PreferenceUtils within preference...

@codeanywhere/filesystem (>=1.13.0, <=1.13.2), @codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4) +199 more potentially affected by CVE-2026-14574 via @theia/core (>=0.7.1, <=1.74.0-next.70)

@theia/core NPM version =0.7.1, =1.13.0, =1.11.0, =0.1.7, =0.0.1, =0.0.1-1569582205, =0.0.1-1646139429, =0.0.1-1569582204, =1.0.0-theia1.27.0, =0.7.0, =0.0.1-next.20220331.125641, =0.0.5, =0.1.0-next.f008ff69 and more Source cves: CVE-2026-14574 Source advisory: SNYK:JS-THEIACORE-18565107...

@codeanywhere/filesystem (>=1.13.0, <=1.13.2), @codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4) +231 more potentially affected by CVE-2026-60009 via @theia/core (>=0.1.1, <=1.74.0-next.70)

@theia/core NPM version =0.1.1, =1.13.0, =1.11.0, =0.1.7, =0.0.1, =0.0.1-1569582205, =0.0.1-1530128588, =0.0.1-1646139429, =0.0.1-1569582204, =1.0.0-theia1.27.0, =1.1.0-next.e29c96e.130 and more Source cves: CVE-2026-60009 Source advisory: MEND:CVE-2026-60009...

@codeanywhere/filesystem (>=1.13.0, <=1.13.2), @codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4) +199 more potentially affected by CVE-2026-14574 via @theia/core (>=0.7.1, <=1.74.0-next.70)

@theia/core NPM version =0.7.1, =1.13.0, =1.11.0, =0.1.7, =0.0.1, =0.0.1-1569582205, =0.0.1-1646139429, =0.0.1-1569582204, =1.0.0-theia1.27.0, =0.7.0, =0.0.1-next.20220331.125641, =0.0.5, =0.1.0-next.f008ff69 and more Source cves: CVE-2026-14574 Source advisory: MEND:CVE-2026-14574...

CVE-2026-14574

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys proto, constructor, prototype. Because this function is invoked by PreferenceServiceImpl.doResolve for eve...

PT-2026-68093

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions 0.7.0 through 1.73.1 Description The PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys such as proto , constructor, and prototype. This function i...

CVE-2026-14574: Improperly Controlled Modification of Object Prototype Attributes

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys proto, constructor, prototype. Because this function is invoked by PreferenceServiceImpl.doResolve for eve...

@codeanywhere/filesystem (>=1.13.0, <=1.13.2), @codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4) +172 more potentially affected by CVE-2026-10055 via @theia/core (>=1.0.0, <=1.73.0-next.60)

@theia/core NPM version =1.0.0, =1.13.0, =1.11.0, =0.1.7, =0.0.1-1646139429, =0.0.1-1585667205, =1.0.0-theia1.27.0, =0.8.0-next.6917503, =0.0.1-next.20220331.125641, =0.0.5, =0.1.0-alpha.3ddb00f8, =0.2.0-next.25250370, =0.2.0-next.ffc3e7a2 and more Source cves: CVE-2026-10055 Source advisory:...

@codeanywhere/filesystem (>=1.13.0, <=1.13.2), @codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4) +172 more potentially affected by CVE-2026-10054 via @theia/core (>=1.0.0, <=1.73.0-next.60)

@theia/core NPM version =1.0.0, =1.13.0, =1.11.0, =0.1.7, =0.0.1-1646139429, =0.0.1-1585667205, =1.0.0-theia1.27.0, =0.8.0-next.6917503, =0.0.1-next.20220331.125641, =0.0.5, =0.1.0-alpha.3ddb00f8, =0.2.0-next.25250370, =0.2.0-next.ffc3e7a2 and more Source cves: CVE-2026-10054 Source advisory:...

Missing Origin Validation in WebSockets

Overview @theia/core is a the main extension for all Theia-based applications, and provides the main framework for all dependent extensions. Affected versions of this package are vulnerable to Missing Origin Validation in WebSockets via the shell-terminal and terminals/:id WebSocket endpoints whe...

Server-side Request Forgery (SSRF)

Overview @theia/core is a the main extension for all Theia-based applications, and provides the main framework for all dependent extensions. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the request-service process. An attacker can access sensitive...

@devpodio/github-extension (1.0.0), @eclipse-glsp-examples/workflow-theia (>=1.0.0-theia1.27.0, <=1.1.0-next.e29c96e.130) +117 more potentially affected by CVE-2026-10055 via @theia/core (>=1.26.0, <=1.73.0-next.60)

@theia/core NPM version =1.26.0, =1.0.0-theia1.27.0, =1.0.0, =0.7.1, =1.58.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.57.0-next.37, =1.73.0-next.60 and more Source cves: CVE-2026-10055 Source advisory: MEND:CVE-2026-10055...

@codeanywhere/filesystem (>=1.13.0, <=1.13.2), @codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4) +136 more potentially affected by CVE-2026-10054 via @theia/core (>=1.9.0-next.16ad46a0, <=1.73.0-next.60)

@theia/core NPM version =1.9.0-next.16ad46a0, =1.13.0, =1.11.0, =0.0.1-1646139429, =1.0.0-theia1.27.0, =1.0.0, =0.0.1-next.20220331.125641, =0.7.1, =1.58.6, =0.0.1, =0.0.10 and more Source cves: CVE-2026-10054 Source advisory: MEND:CVE-2026-10054...