| CVE-2026-82217 |
In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools…
|
8.8
High
|
Aug 31, 2026 |
| CVE-2026-19884 |
In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without…
|
8.4
High
|
Aug 14, 2026 |
| CVE-2026-61891 |
In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download…
|
7.5
High
|
Aug 5, 2026 |
| CVE-2026-60009 |
In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every…
|
8.8
High
|
Aug 5, 2026 |
| CVE-2026-12609 |
In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the…
|
7.5
High
|
Aug 5, 2026 |
| CVE-2026-14574 |
In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core`…
|
5.7
Medium
|
Aug 5, 2026 |
| CVE-2026-10055 |
In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from…
|
8.5
High
|
Jul 3, 2026 |
| CVE-2026-10054 |
In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over…
|
8.8
High
|
Jul 3, 2026 |
| CVE-2026-44691 |
In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g
|
8.4
High
|
Jun 18, 2026 |
| CVE-2026-22551 |
In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP…
|
6.7
Medium
|
Jun 18, 2026 |
| CVE-2026-46580 |
In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were…
|
8.4
High
|
Jun 18, 2026 |
| CVE-2026-44688 |
In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its…
|
8.4
High
|
Jun 18, 2026 |