CVE-2026-10054 affects Eclipse Theia 1.8.1 by exposing privileged terminal RPC over WebSocket endpoints without service-level authentication. The origin validation in the @theia/core WebSocket implementation is fail-open, accepting connections when the Origin header is missing or when no THEIA_HOSTS allowlist is configured (which is the default). Additionally, the Socket.IO integration replaces the real Origin header with a client-controlled fix-origin header, which can be manipulated or omitted by attackers. Consequently, a malicious web page visited by a user running Theia can open the /services WebSocket namespace, create terminals, attach to terminal data channels, execute arbitrary OS commands, and read their output. This affects both local developer setups and hosted or tunneled deployments lacking strong external authentication. A fix is under development to enforce same-origin validation by default, remove trust in the fix-origin header, require a SameSite=Strict; HttpOnly connection-token cookie for HTTP and WebSocket access, and sanitize shell terminal creation options.

An attacker can remotely execute arbitrary operating system commands and read their output by exploiting the lack of proper origin validation and authentication on WebSocket terminal services. This compromises confidentiality, integrity, and availability of the affected system. Both local and hosted deployments without strong external authentication are vulnerable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. A fix is in development that will enforce strict same-origin validation, remove trust in the client-supplied fix-origin header, require a SameSite=Strict; HttpOnly connection-token cookie for access, and sanitize terminal creation options. Until a fix is released, users should apply strong external authentication controls and avoid exposing Theia instances to untrusted networks or browsers.