@devpodio/github-extension (1.0.0), @eclipse-glsp-examples/workflow-theia (>=1.0.0-theia1.27.0, <=1.1.0-next.e29c96e.130) +119 more potentially affected by CVE-2026-10055 via @theia/request (>=1.26.0, <=1.72.3)

@theia/request NPM version =1.26.0, =1.0.0-theia1.27.0, =1.0.0, =0.7.1, =1.58.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.57.0-next.37, =1.46.0-next.241, =1.72.3 and more Source cves: CVE-2026-10055 Source advisory: SNYK:JS-THEIAREQUEST-17810719...

Server-side Request Forgery (SSRF)

Overview @theia/request is a Theia Proxy-Aware Request Service Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the request-service process. An attacker can access sensitive internal resources by sending crafted URLs to the backend, which then performs...