Threat Intelligence Database

Eclipse Theia version 1.26.0 contains a server-side request forgery (SSRF) vulnerability in its backend /services/request-service RPC. The service accepts attacker-controlled URLs without validation or allowlisting, enabling remote attackers with access to the Theia service connection to make HTTP requests from the server to internal or otherwise protected resources. This can expose sensitive internal endpoints and metadata services. The vulnerability affects deployments where untrusted users can reach the Theia service connection, such as multi-tenant or publicly accessible setups. No official patch or remediation has been confirmed yet.

Eclipse Theia version 1.8.1 has a vulnerability in its WebSocket implementation where origin validation is missing or improperly enforced. This allows a malicious web page to connect to privileged terminal RPC services without proper authentication, potentially enabling remote command execution and data access. The vulnerability arises from fail-open origin checks and trust in a client-supplied header. A fix is in development to enforce strict origin validation and improve authentication.