Prototype Pollution

Overview @theia/core is a the main extension for all Theia-based applications, and provides the main framework for all dependent extensions. Affected versions of this package are vulnerable to Prototype Pollution via the PreferenceUtils.merge function in PreferenceUtils within preference...

@codeanywhere/filesystem (>=1.13.0, <=1.13.2), @codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4) +176 more potentially affected by CVE-2026-14574 via @theia/core (>=0.7.0-next.a88ef75e, <=1.73.1)

@theia/core NPM version =0.7.0-next.a88ef75e, =1.13.0, =1.11.0, =0.0.1, =0.0.1-1569582205, =0.0.1-1646139429, =0.0.1-1569582204, =1.0.0-theia1.27.0, =0.7.0, =0.0.1-next.20220331.125641, =0.0.1-next.20230109-144401 - @fangoling/ai-terminal-assistant 0.1.0 - @hypernetwork/galileo-ide-widget 1.1.6 a...

CVE-2026-14574

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys proto, constructor, prototype. Because this function is invoked by PreferenceServiceImpl.doResolve for eve...

PT-2026-68093

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions 0.7.0 through 1.73.1 Description The PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys such as proto , constructor, and prototype. This function i...

CVE-2026-14574: Improperly Controlled Modification of Object Prototype Attributes

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys proto, constructor, prototype. Because this function is invoked by PreferenceServiceImpl.doResolve for eve...

Missing Origin Validation in WebSockets

Overview @theia/core is a the main extension for all Theia-based applications, and provides the main framework for all dependent extensions. Affected versions of this package are vulnerable to Missing Origin Validation in WebSockets via the shell-terminal and terminals/:id WebSocket endpoints whe...

@codeanywhere/filesystem (>=1.13.0, <=1.13.2), @codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4) +147 more potentially affected by CVE-2026-10055 via @theia/core (>=1.0.0, <=1.72.3)

@theia/core NPM version =1.0.0, =1.13.0, =1.11.0, =0.0.1-1646139429, =0.0.1-1585667205, =1.0.0-theia1.27.0, =0.8.0-next.0b7d765, =0.0.1-next.20220331.125641, =0.7.1, =0.9.1 - @popcornsar/che-theia-plugin-ext 7.4.0 and more Source cves: CVE-2026-10055 Source advisory: SNYK:JS-THEIACORE-17810718...

Server-side Request Forgery (SSRF)

Overview @theia/core is a the main extension for all Theia-based applications, and provides the main framework for all dependent extensions. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the request-service process. An attacker can access sensitive...

@codeanywhere/filesystem (>=1.13.0, <=1.13.2), @codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4) +147 more potentially affected by CVE-2026-10054 via @theia/core (>=1.0.0, <=1.72.3)

@theia/core NPM version =1.0.0, =1.13.0, =1.11.0, =0.0.1-1646139429, =0.0.1-1585667205, =1.0.0-theia1.27.0, =0.8.0-next.0b7d765, =0.0.1-next.20220331.125641, =0.7.1, =0.9.1 - @popcornsar/che-theia-plugin-ext 7.4.0 and more Source cves: CVE-2026-10054 Source advisory: SNYK:JS-THEIACORE-17810710...