CVE-2026-14574 affects Eclipse Theia versions from 0.7.0 up to and including 1.73.1. The vulnerability arises from the PreferenceUtils.merge function in the @theia/core package, which recursively merges preference values without filtering out prototype-related keys such as __proto__, constructor, and prototype. Since this function is called by PreferenceServiceImpl.doResolve for every preference resolution across multiple scopes (default, user, workspace, folder), an attacker can craft a preference value in a workspace settings file (.theia/settings.json or .vscode/settings.json) that pollutes Object.prototype. This pollution can alter application logic across the Theia process, potentially leading to unexpected behavior or security issues.

An attacker with the ability to modify workspace settings files can exploit this vulnerability to perform prototype pollution, which may alter the behavior of the Eclipse Theia application process. This can lead to unintended side effects or logic changes within the application. The CVSS 4.0 score is 5.7 (medium severity), indicating a moderate impact with local attack vector and user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid opening workspaces with untrusted or potentially malicious settings files to prevent exploitation of this prototype pollution vulnerability.