CVE-2026-14574

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values without rejecting prototype-related keys (`__proto__`, `constructor`, `prototype`). Because this function is invoked by `PreferenceServiceImpl.doResolve` for every preference resolution across scopes (default, user, workspace, folder), a crafted preference value in a workspace settings file (`.theia/settings.json` or `.vscode/settings.json`) can pollute `Object.prototype` when the user opens the workspace, potentially altering application logic across the Theia process.

CWE	CWE-1321
Vendor	eclipse foundation
Product	eclipse theia
Published	Aug 5, 2026

Stay Ahead of the Next One

Get instant alerts for eclipse foundation eclipse theia

Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse theia are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Eclipse Foundation / Eclipse Theia

0.7.0 < 1.74.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/eclipse-theia/theia/security/advisories/GHSA-f3w9-qfw3-xr32 gitlab.eclipse.org: https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/567 gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/157

Credits

Wu Junming (https://gitlab.eclipse.org/dremig)