CVE-2026-44688 is a vulnerability in Eclipse Theia before version 1.71.0 involving improper neutralization of input used for large language model (LLM) prompting (CWE-1427). The AI chat agent includes workspace file and directory names in its prompt context without distinguishing them from system instructions. An attacker can exploit this by creating a malicious repository with crafted directory or file names that cause the AI agent to follow attacker-controlled instructions (indirect prompt injection). This can be combined with other AI chat features in untrusted workspaces to enable attack chains resulting in data exfiltration via Markdown image rendering or arbitrary command execution through task definitions. The CVSS 4.0 base score is 8.4 (high severity), with local attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

The vulnerability allows attackers to indirectly inject prompts into the AI chat agent by manipulating workspace file and directory names. This can lead to the AI agent executing attacker-controlled instructions, which may result in data exfiltration through Markdown image rendering or arbitrary command execution via task definitions. The impact affects confidentiality, integrity, and availability of the system and data processed by Eclipse Theia's AI chat features.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid opening untrusted or malicious repositories in Eclipse Theia versions prior to 1.71.0, especially when using AI chat features. Monitor vendor communications for updates on patches or official mitigations.