Eclipse Theia vulnerabilities

In Eclipse Theia up to version 1.69.0, opening a folder starts source control integration without first asking the user to trust the folder. Applications built on Theia that include git integration execute git commands (e.g., git status) as soon as a repository is detected. Because git honors repository-local configuration, a folder with an attacker-controlled .git/config containing core.fsmonitor can cause the configured command to be executed. Cloning an attacker-supplied repository and opening it in a Theia-based application is sufficient to execute arbitrary commands with user privileges, without any confirmation prompt.

In Eclipse Theia up to 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints without confining to the workspace. In browser mode, the connection token is not enforced for HTTP requests, allowing unauthenticated clients to read any file readable by the backend process.

In Eclipse Theia up to version 1.73.1, the @theia/filesystem backend exposes POST /file-upload, which takes an attacker-supplied absolute path and performs fs.move without workspace confinement or authentication. In browser deployments, the connection token is enforced only on WebSocket upgrades, and tokenless HTTP requests are not rejected, allowing unauthenticated arbitrary file write outside the workspace, potentially leading to remote code execution.

The PreferenceUtils.merge function in Eclipse Theia recursively merges preference values without rejecting prototype-related keys (__proto__, constructor, prototype). This can lead to Object.prototype pollution when a user opens a workspace with a crafted settings file.

In Eclipse Theia versions 1.66.0 through 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path(*) HTTP endpoint, which resolves file paths without verifying they stay within the plugin directory. An unauthenticated attacker can use percent-encoded '../' sequences to escape the directory and read arbitrary files accessible to the backend process.

In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC endpoint accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller. Because the destination URL is neither validated nor allowlisted, a remote attacker with access to the Theia service connection can issue server-side HTTP requests to localhost or other backend-reachable hosts and read their responses.

In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket without service-level authentication. WebSocket origin validation is fail-open, allowing attackers to execute arbitrary OS commands.

In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded, which could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing prompt template files that, when the workspace was opened in Theia, replaced the AI's system instructions with attacker-controlled content.

In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user's privileges.

In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository with adversarial directory or file names, leading to the execution of attacker-controlled instructions.

In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering unrestricted HTTP requests to external URLs. Combined with prompt injection in a malicious workspace, an attacker could induce the AI agent to construct image URLs encoding sensitive information.