Threat Intelligence Database

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own `@theia/git` extension and the builtin VS Code `git` extension run git commands such as `git status` as soon as a repository is detected. Since git honors repository-local configuration, a folder containing an attacker-controlled `.git/config` with `core.fsmonitor` (or a comparable hook-like setting) causes the configured command to be executed. The configuration can be delivered by burying a bare repository inside a regular repository (OVE-20210718-0001), so cloning an attacker-supplied repository and opening it in a Theia-based application is sufficient to execute arbitrary commands with the privileges of the user, without any confirmation prompt. As of 1.70.0, plugins that declare `capabilities.untrustedWorkspaces.supported: false`, which includes the builtin git extension, are no longer loaded or activated in an untrusted workspace, and the deprecated `@theia/git` extension has been removed, so no git command is executed against an untrusted folder.

Eclipse Theia versions up to and including 1.73.1 have a vulnerability in the @theia/filesystem backend where HTTP file-download endpoints allow unauthenticated clients to read arbitrary files on the backend filesystem. This occurs because client-supplied URIs are converted directly to filesystem paths without confinement, and HTTP middleware does not enforce token validation for non-WebSocket HTTP requests in browser deployments. Electron mode is not affected by this issue.

Eclipse Theia versions 0.7.0 through 1.73.1 contain a vulnerability in the PreferenceUtils.merge function that allows prototype pollution via crafted preference values in workspace settings files. This occurs because the merge function does not reject prototype-related keys, potentially altering application logic when a workspace is opened.