CVE-2026-82217

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools writeFileContent, suggestFileContent, and the replacement and state helpers resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc,...

EUVD-2026-68519

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools writeFileContent, suggestFileContent, and the replacement and state helpers resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc,...

CVE-2026-82217

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools writeFileContent, suggestFileContent, and the replacement and state helpers resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc,...

CVE-2026-82217

Eclipse Theia versions 1.73.0 through 1.74.9 are affected by a path traversal vulnerability in the AI "Agent Mode" file-change tools (writeFileContent , suggestFileContent , and related helpers). The root cause is the absence of a workspace-containment check on model-supplied file paths, allowing...

PT-2026-83818

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions 1.73.0 through 1.74.x Description In AI Agent Mode, file-change tools resolve model-supplied file paths without verifying if they are contained within the workspace. This allows a crafted relative path, an absolute path,...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

EUVD-2026-58685

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

CVE-2026-19884

The CVE affects Eclipse Theia up to v1.69.0, where opening a folder can trigger source control integration and run git commands (e.g., git status) without user trust. A repository-local .git/config containing core.fsmonitor or similar settings can cause arbitrary commands to execute with the user...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

PT-2026-72042

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own @theia/git extension an...

@codeanywhere/filesystem (>=1.13.0, <=1.13.2), @codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4) +196 more potentially affected by CVE-2026-14574 via @theia/core (>=0.7.0-next.a88ef75e, <=1.73.1)

@theia/core NPM version =0.7.0-next.a88ef75e, =1.13.0, =1.11.0, =0.1.7, =0.0.1, =0.0.1-1569582205, =0.0.1-1646139429, =0.0.1-1569582204, =1.0.0-theia1.27.0, =0.7.0, =0.0.1-next.20220331.125641, =0.0.5, =0.1.0-next.f008ff69 and more Source cves: CVE-2026-14574 Source advisory:...

@theia/ai-registry (>=1.73.0-next.2, <=1.73.1), @theia/plugin-dev (>=1.66.0-next.0, <=1.73.1) +4 more potentially affected by CVE-2026-12609 via @theia/plugin-ext (>=1.66.0, <=1.73.1)

@theia/plugin-ext NPM version =1.66.0, =1.73.0-next.2, =1.66.0-next.0, =1.66.0-next.0, =1.66.0-next.0, =1.66.0-next.0, =1.66.0-next.0, =1.73.1 Source cves: CVE-2026-12609 Source advisory: SNYK:JS-THEIAPLUGINEXT-18565098...

@codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4), @devpodio/github-extension (1.0.0) +142 more potentially affected by CVE-2026-60009 via @theia/filesystem (>=1.0.0, <=1.73.1)

@theia/filesystem NPM version =1.0.0, =1.11.0, =0.1.7, =0.0.1-1585667205, =0.8.0-next.6917503, =0.0.1-next.20220331.125641, =0.0.5, =0.1.0-alpha.3ddb00f8, =0.2.0-next.25250370, =0.7.1, =0.9.1 - @pivotal-tools/theia-languageclient 0.0.5-alpha and more Source cves: CVE-2026-60009 Source advisory:...

CVE-2026-61891

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints GET /file, GET /files/, PUT /files/ that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any...

CVE-2026-14574

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys proto, constructor, prototype. Because this function is invoked by PreferenceServiceImpl.doResolve for eve...

CVE-2026-60009

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend binds POST /file-upload in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart uri field and calls fs.movetmp, target, overwrite: true with no workspace...

CVE-2026-12609

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path HTTP endpoint, which resolves the requested file path with path.resolvelocalPath, filePath without verifying that the resolved path stays within the plugin's...

CVE-2026-61891

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints GET /file, GET /files/, PUT /files/ that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any...