Threats affecting pkg:github/Eclipse Theia

Eclipse Theia versions prior to 1.69.0 allow execution of custom task definitions from workspace files without requiring workspace trust. This vulnerability enables an attacker to craft a malicious repository that, when opened in Theia, executes arbitrary commands with the user's privileges. The issue can be exacerbated by AI chat features combined with workspace settings that disable tool confirmation, potentially triggering automatic execution. The vulnerability is identified as CWE-829 and has a high severity with a CVSS score of 8.4.

In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an attacker could induce the AI agent to construct image URLs encoding sensitive information from the workspace or conversation context, exfiltrating it to attacker-controlled servers. The workspace trust enforcement introduced in v1.71.0 mitigates the documented attack chain by disabling AI features in untrusted workspaces.

Eclipse Theia versions prior to 1.71.0 automatically load files matching the pattern .prompts/*.prompttemplate from a workspace, which can override or extend AI agent system prompts. This behavior allows an attacker to craft a malicious repository that replaces the AI's system instructions with attacker-controlled content, leading to indirect prompt injection. Exploitation combined with other AI chat features in untrusted workspaces can result in data exfiltration via Markdown image rendering or arbitrary command execution via task definitions. The vulnerability has a high severity with a CVSS score of 8.4.

Eclipse Theia versions prior to 1.71.0 contain a vulnerability where the AI chat agent improperly neutralizes input used for prompting. Specifically, workspace file and directory names are processed as part of the prompt context without differentiation from system instructions. This flaw allows attackers to craft malicious repositories with adversarial file or directory names that can manipulate the AI agent's behavior, potentially leading to data exfiltration or arbitrary command execution.