Prototype Pollution

Overview @theia/core is a the main extension for all Theia-based applications, and provides the main framework for all dependent extensions. Affected versions of this package are vulnerable to Prototype Pollution via the PreferenceUtils.merge function in PreferenceUtils within preference...

EUVD-2026-53302

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys proto, constructor, prototype. Because this function is invoked by PreferenceServiceImpl.doResolve for eve...

CVE-2026-14574

CVE-2026-14574 affects Eclipse Theia versions 0.7.0 through 1.73.1. Theia’s @theia/core:PreferenceUtils.merge recursively merges preference values without rejecting prototype-related keys (e.g., proto , constructor, prototype). This function is invoked by PreferenceServiceImpl.doResolve for every...