CVE-2026-44691
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user's privileges. In combination with AI chat features and a workspace .theia/settings.json that disabled tool confirmation, this could be triggered automatically by sending a message in the AI chat.
| CWE | CWE-829 |
| Vendor | eclipse foundation |
| Product | eclipse theia |
| Published | Jun 18, 2026 |
| Last Updated | Jun 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for eclipse foundation eclipse theia
Be the first to know when new unknown vulnerabilities affecting eclipse foundation eclipse theia are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Eclipse Foundation / Eclipse Theia
0 < 1.69.0
References
Credits
Piotr Ryciak (https://gitlab.eclipse.org/void01)