5.7
Medium
CVE-2026-14574 In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core`…
Description
In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values without rejecting prototype-related keys (`__proto__`, `constructor`, `prototype`). Because this function is invoked by `PreferenceServiceImpl.doResolve` for every preference resolution across scopes (default, user, workspace, folder), a crafted preference value in a workspace settings file (`.theia/settings.json` or `.vscode/settings.json`) can pollute `Object.prototype` when the user opens the workspace, potentially altering application logic across the Theia process.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse Theia 0.7 | 0.7.0 → < 1.74.0 | 1.74.0 |
References
- github.com github.com
- gitlab.eclipse.org gitlab.eclipse.org
- gitlab.eclipse.org gitlab.eclipse.org
Timeline
- Published
- Last modified
Other CVEs of Eclipse Theia
The 12 CVEs of Eclipse Theia →
CVE-2026-82217
In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools…
8.8
High
CVE-2026-19884
In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without…
8.4
High
CVE-2026-61891
In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download…
7.5
High
CVE-2026-60009
In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every…
8.8
High