In Eclipse Theia versions 0.7.0 up to and including 1.73.1, the PreferenceUtils.merge function in the @theia/core package recursively merges preference values without filtering out prototype-related keys such as __proto__, constructor, and prototype. This function is called by PreferenceServiceImpl.doResolve for every preference resolution across multiple scopes (default, user, workspace, folder). An attacker can craft a preference value in a workspace settings file (.theia/settings.json or .vscode/settings.json) that pollutes Object.prototype, potentially altering application logic throughout the Theia process.

Successful exploitation allows an attacker with the ability to modify workspace settings files to perform prototype pollution, which can lead to unexpected behavior or logic changes in the application process. This may affect the integrity of the application but requires user interaction (opening the workspace) and local or workspace file modification privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid opening workspaces with untrusted or suspicious settings files to prevent prototype pollution via crafted preferences.