CVE-2026-46580

In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing prompt template files that, when the workspace was opened in Theia, replaced the AI's system instructions with attacker-controlled content (indirect prompt injection). Combined with other AI chat features available in untrusted workspaces, this enabled attack chains leading to data exfiltration via Markdown image rendering or arbitrary command execution via task definitions.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/114	Vendor Advisory Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:*

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) En versiones de Eclipse Theia anteriores a la 1.71.0, los archivos que coincidían con el patrón .prompts/*.prompttemplate en un espacio de trabajo se cargaban automáticamente y podían anular o extender las instrucciones del sistema del agente de IA. Un atacante podía crear un repositorio malicioso que contenía archivos de plantilla de prompt que, al abrir el espacio de trabajo en Theia, reemplazaban las instrucciones del sistema de la IA con contenido controlado por el atacante (inyección de prompt indirecta). Combinado con otras características de chat de IA disponibles en espacios de trabajo no confiables, esto permitía cadenas de ataque que conducían a la exfiltración de datos a través de la renderización de imágenes Markdown o la ejecución de comandos arbitrarios a través de definiciones de tareas.

Information

Published : 2026-06-18 16:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-46580

Mitre link : CVE-2026-46580

CVE.ORG link : CVE-2026-46580

JSON object : View

Products Affected

eclipse

theia

CWE

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

{"id": "CVE-2026-46580", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46580", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-18T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "emo@eclipse.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "emo@eclipse.org", "affectedData": [{"repo": "https://github.com/eclipse-theia/theia", "vendor": "Eclipse Foundation", "product": "Eclipse Theia", "versions": [{"status": "affected", "version": "0", "lessThan": "1.71.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-18T16:16:54.213", "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/114", "tags": ["Vendor Advisory", "Patch"], "source": "emo@eclipse.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "emo@eclipse.org", "description": [{"lang": "en", "value": "CWE-829"}]}], "descriptions": [{"lang": "en", "value": "In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing prompt template files that, when the workspace was opened in Theia, replaced the AI's system instructions with attacker-controlled content (indirect prompt injection). Combined with other AI chat features available in untrusted workspaces, this enabled attack chains leading to data exfiltration via Markdown image rendering or arbitrary command execution via task definitions."}, {"lang": "es", "value": "En versiones de Eclipse Theia anteriores a la 1.71.0, los archivos que coincid\u00edan con el patr\u00f3n .prompts/*.prompttemplate en un espacio de trabajo se cargaban autom\u00e1ticamente y pod\u00edan anular o extender las instrucciones del sistema del agente de IA. Un atacante pod\u00eda crear un repositorio malicioso que conten\u00eda archivos de plantilla de prompt que, al abrir el espacio de trabajo en Theia, reemplazaban las instrucciones del sistema de la IA con contenido controlado por el atacante (inyecci\u00f3n de prompt indirecta). Combinado con otras caracter\u00edsticas de chat de IA disponibles en espacios de trabajo no confiables, esto permit\u00eda cadenas de ataque que conduc\u00edan a la exfiltraci\u00f3n de datos a trav\u00e9s de la renderizaci\u00f3n de im\u00e1genes Markdown o la ejecuci\u00f3n de comandos arbitrarios a trav\u00e9s de definiciones de tareas."}], "lastModified": "2026-10-26T11:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "162528FA-7AE5-4808-8756-2FDF93ED0DD2", "versionEndExcluding": "1.71.0"}], "operator": "OR"}]}], "sourceIdentifier": "emo@eclipse.org"}