CVE-2026-19884: CWE-829 in Eclipse Foundation Eclipse Theia
In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own `@theia/git` extension and the builtin VS Code `git` extension run git commands such as `git status` as soon as a repository is detected. Since git honors repository-local configuration, a folder containing an attacker-controlled `.git/config` with `core.fsmonitor` (or a comparable hook-like setting) causes the configured command to be executed. The configuration can be delivered by burying a bare repository inside a regular repository (OVE-20210718-0001), so cloning an attacker-supplied repository and opening it in a Theia-based application is sufficient to execute arbitrary commands with the privileges of the user, without any confirmation prompt. As of 1.70.0, plugins that declare `capabilities.untrustedWorkspaces.supported: false`, which includes the builtin git extension, are no longer loaded or activated in an untrusted workspace, and the deprecated `@theia/git` extension has been removed, so no git command is executed against an untrusted folder.
AI Analysis
Technical Summary
In Eclipse Theia versions <=1.69.0, opening a folder initiates source control integration immediately, running git commands such as 'git status' without user confirmation. Since git respects repository-local configurations, an attacker can craft a repository with a malicious '.git/config' that uses 'core.fsmonitor' or similar hooks to execute arbitrary commands. This can be triggered by cloning and opening a malicious repository in a Theia-based application, resulting in command execution with the user's privileges. From version 1.70.0, Theia disables git extensions in untrusted workspaces and removes the deprecated '@theia/git' extension, preventing this automatic execution in untrusted contexts.
Potential Impact
An attacker can execute arbitrary commands on the user's system with the user's privileges by supplying a malicious git repository that triggers git hooks via repository-local configuration. This occurs without any user confirmation when opening the folder in affected versions, potentially leading to system compromise or unauthorized actions.
Mitigation Recommendations
Upgrade to Eclipse Theia version 1.70.0 or later, where git extensions are disabled in untrusted workspaces and the deprecated '@theia/git' extension is removed, preventing automatic execution of git commands on untrusted folders. Patch status is not explicitly confirmed beyond this version; users should verify vendor advisories for current remediation guidance.
CVE-2026-19884: CWE-829 in Eclipse Foundation Eclipse Theia
Description
In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own `@theia/git` extension and the builtin VS Code `git` extension run git commands such as `git status` as soon as a repository is detected. Since git honors repository-local configuration, a folder containing an attacker-controlled `.git/config` with `core.fsmonitor` (or a comparable hook-like setting) causes the configured command to be executed. The configuration can be delivered by burying a bare repository inside a regular repository (OVE-20210718-0001), so cloning an attacker-supplied repository and opening it in a Theia-based application is sufficient to execute arbitrary commands with the privileges of the user, without any confirmation prompt. As of 1.70.0, plugins that declare `capabilities.untrustedWorkspaces.supported: false`, which includes the builtin git extension, are no longer loaded or activated in an untrusted workspace, and the deprecated `@theia/git` extension has been removed, so no git command is executed against an untrusted folder.
CVSS v4.0
Score 8.4high
Affected software
Eclipse Foundation
Eclipse Theia
pkg:github/eclipse-theia/theiaRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Eclipse Theia versions <=1.69.0, opening a folder initiates source control integration immediately, running git commands such as 'git status' without user confirmation. Since git respects repository-local configurations, an attacker can craft a repository with a malicious '.git/config' that uses 'core.fsmonitor' or similar hooks to execute arbitrary commands. This can be triggered by cloning and opening a malicious repository in a Theia-based application, resulting in command execution with the user's privileges. From version 1.70.0, Theia disables git extensions in untrusted workspaces and removes the deprecated '@theia/git' extension, preventing this automatic execution in untrusted contexts.
Potential Impact
An attacker can execute arbitrary commands on the user's system with the user's privileges by supplying a malicious git repository that triggers git hooks via repository-local configuration. This occurs without any user confirmation when opening the folder in affected versions, potentially leading to system compromise or unauthorized actions.
Mitigation Recommendations
Upgrade to Eclipse Theia version 1.70.0 or later, where git extensions are disabled in untrusted workspaces and the deprecated '@theia/git' extension is removed, preventing automatic execution of git commands on untrusted folders. Patch status is not explicitly confirmed beyond this version; users should verify vendor advisories for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- eclipse
- Date Reserved
- 2026-08-14T15:09:42.140Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a7f373bbf8831d5394a6b6a
Added to database: 08/14/2026, 15:41:47 UTC
Last enriched: 08/22/2026, 13:25:27 UTC
Last updated: 09/27/2026, 01:47:40 UTC
Views: 69
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.