gha-lab-b5c1313658

自动化研究产物 — 非上游项目。 本仓库是由自动化工具链构建的一次性实验环境，用于拉瓦尔大学（Université Laval）硕士论文中复现已发表的 GitHub Actions 工作流漏洞研究。它是 eclipse-theia/theia-website 在提交 d272e2418221240a7c9f8480dd0576a65ca49625（2026-01-19）时的逐字快照，依据该项目自身的许可证重新分发，该许可证文件已原样包含在本快照中。 上游项目未 参与其中，也从未...

Directory Traversal

Overview @theia/ai-ide is an AI IDE Agents Extension Affected versions of this package are vulnerable to Directory Traversal through the AI Agent Mode file-change tools in the workspace path resolution code. An attacker can write or delete files outside the workspace by supplying a crafted relati...

CVE-2026-82217

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools writeFileContent, suggestFileContent, and the replacement and state helpers resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc,...

CVE-2026-82217

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools writeFileContent, suggestFileContent, and the replacement and state helpers resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc,...

CVE-2026-82217

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools writeFileContent, suggestFileContent, and the replacement and state helpers resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc,...

EUVD-2026-68519

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools writeFileContent, suggestFileContent, and the replacement and state helpers resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc,...

CVE-2026-82217

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools writeFileContent, suggestFileContent, and the replacement and state helpers resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc,...

CVE-2026-82217

Eclipse Theia versions 1.73.0 through 1.74.9 are affected by a path traversal vulnerability in the AI "Agent Mode" file-change tools (writeFileContent , suggestFileContent , and related helpers). The root cause is the absence of a workspace-containment check on model-supplied file paths, allowing...

PT-2026-83818

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions 1.73.0 through 1.74.x Description In AI Agent Mode, file-change tools resolve model-supplied file paths without verifying if they are contained within the workspace. This allows a crafted relative path, an absolute path,...

Inclusion of Functionality from Untrusted Control Sphere

Overview @theia/plugin-ext is a Theia - Plugin Extension Affected versions of this package are vulnerable to Inclusion of Functionality from Untrusted Control Sphere due to missing workspace-trust enforcement in the plugin and extension loading path. An attacker can execute commands with the user...

Inclusion of Functionality from Untrusted Control Sphere

Overview @theia/plugin-ext-vscode is a Theia - Plugin Extension for VsCode Affected versions of this package are vulnerable to Inclusion of Functionality from Untrusted Control Sphere due to missing workspace-trust enforcement in the plugin and extension loading path. An attacker can execute...

@popcornsar/che-theia-plugin-ext (7.4.0), @popcornsar/theia-dashboard-extension (7.4.0-v1) +16 more potentially affected by CVE-2026-19884 via @theia/plugin-ext (>=1.0.0, <=1.69.0-next.81)

@theia/plugin-ext NPM version =1.0.0, =1.1.0-next.14531578, =1.46.0-next.72, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.1.0-next.14531578, =1.59.0, =0.0.17, =0.0.6, =0.0.19, =0.0.6, =0.0.21 and more Source cves: CVE-2026-19884 Source advisory: SNYK:JS-THEIAPLUGINEXT-18855352...

@theia/vsx-registry (>=1.1.0-next.14531578, <=1.69.0), openvsx-server (>=1.59.0, <=1.59.1) potentially affected by CVE-2026-19884 via @theia/plugin-ext-vscode (>=1.1.0-next.a62a6b92, <=1.69.0-next.81)

@theia/plugin-ext-vscode NPM version =1.1.0-next.a62a6b92, =1.1.0-next.14531578, =1.59.0, =1.59.1 Source cves: CVE-2026-19884 Source advisory: SNYK:JS-THEIAPLUGINEXTVSCODE-18855353...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

EUVD-2026-58685

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

CVE-2026-19884

The CVE affects Eclipse Theia up to v1.69.0, where opening a folder can trigger source control integration and run git commands (e.g., git status) without user trust. A repository-local .git/config containing core.fsmonitor or similar settings can cause arbitrary commands to execute with the user...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...