CVE-2026-44688

In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository with adversarial directory or file names that, when analyzed by the AI agent, would cause the agent to follow attacker-controlled instructions (indirect prompt injection). Combined with other AI chat features available in untrusted workspaces, this enabled attack chains leading to data exfiltration via Markdown image rendering or arbitrary command execution via task definitions.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/113	Vendor Advisory Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:*

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) En versiones de Eclipse Theia anteriores a la 1.71.0, el agente de chat de IA procesaba los nombres de archivos y directorios del espacio de trabajo como parte de su contexto de prompt sin distinguirlos de las instrucciones del sistema. Un atacante podría crear un repositorio malicioso con nombres de directorio o archivo adversarios que, al ser analizados por el agente de IA, harían que el agente siguiera instrucciones controladas por el atacante (inyección de prompt indirecta). Combinado con otras características de chat de IA disponibles en espacios de trabajo no confiables, esto permitía cadenas de ataque que conducían a la exfiltración de datos a través de la renderización de imágenes Markdown o la ejecución arbitraria de comandos a través de definiciones de tareas.

Information

Published : 2026-06-18 16:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-44688

Mitre link : CVE-2026-44688

CVE.ORG link : CVE-2026-44688

JSON object : View

Products Affected

eclipse

theia

CWE

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

{"id": "CVE-2026-44688", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44688", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-18T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"repo": "https://github.com/eclipse-theia/theia", "vendor": "Eclipse Foundation", "product": "Eclipse Theia", "versions": [{"status": "affected", "version": "0", "lessThan": "1.71.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-18T16:16:53.977", "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/113", "tags": ["Vendor Advisory", "Patch"], "source": "emo@eclipse.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-829"}]}], "descriptions": [{"lang": "en", "value": "In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository with adversarial directory or file names that, when analyzed by the AI agent, would cause the agent to follow attacker-controlled instructions (indirect prompt injection). Combined with other AI chat features available in untrusted workspaces, this enabled attack chains leading to data exfiltration via Markdown image rendering or arbitrary command execution via task definitions."}, {"lang": "es", "value": "En versiones de Eclipse Theia anteriores a la 1.71.0, el agente de chat de IA procesaba los nombres de archivos y directorios del espacio de trabajo como parte de su contexto de prompt sin distinguirlos de las instrucciones del sistema. Un atacante podr\u00eda crear un repositorio malicioso con nombres de directorio o archivo adversarios que, al ser analizados por el agente de IA, har\u00edan que el agente siguiera instrucciones controladas por el atacante (inyecci\u00f3n de prompt indirecta). Combinado con otras caracter\u00edsticas de chat de IA disponibles en espacios de trabajo no confiables, esto permit\u00eda cadenas de ataque que conduc\u00edan a la exfiltraci\u00f3n de datos a trav\u00e9s de la renderizaci\u00f3n de im\u00e1genes Markdown o la ejecuci\u00f3n arbitraria de comandos a trav\u00e9s de definiciones de tareas."}], "lastModified": "2026-10-26T11:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "162528FA-7AE5-4808-8756-2FDF93ED0DD2", "versionEndExcluding": "1.71.0"}], "operator": "OR"}]}], "sourceIdentifier": "emo@eclipse.org"}