~ / search / GHSA-g9jw-92q7-g7fj

GHSA-g9jw-92q7-g7fj

[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions

Source: GitHub Advisory Database (reviewed) High CVE-2026-44691

Packages

EcosystemPackageAffectedFixed in
npm @theia/debug < 1.69.0 1.69.0
npm @theia/task < 1.69.0 1.69.0
npm @theia/workspace < 1.69.0 1.69.0

Details

As written in the advisory (Markdown source, shown as plain text).

In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user's privileges. In combination with AI chat features and a workspace .theia/settings.json that disabled tool confirmation, this could be triggered automatically by sending a message in the AI chat.

References

External links from the advisory. They lead to third-party sites.