Executive brief
Eclipse Theia, an extensible platform for building IDE-like applications, contains a vulnerability that allows malicious websites to execute commands on a developer's machine. If a user visits a compromised or malicious webpage while running a Theia-based application, the webpage can secretly connect to the application's terminal service. This allows an attacker to run arbitrary code, access private files, and steal sensitive data from the development environment.
Technical details
Eclipse Theia (versions 1.8.1 to 1.72.x) exposes terminal RPC services (/services/shell-terminal) over WebSockets without service-level authentication. The vulnerability stems from a fail-open WebSocket origin validation in @theia/core that accepts connections when the Origin header is missing or when THEIA_HOSTS is unconfigured. Furthermore, the Socket.IO integration allows a client-supplied 'fix-origin' header to override the actual Origin header. An attacker can exploit this via a drive-by attack where a victim visits a malicious site; the site then connects to the local or hosted Theia backend, creates a terminal, and executes arbitrary OS commands via the PTY spawn path. A fix in version 1.73.0 enforces same-origin validation and introduces a connection-token cookie.
Affected products
- Eclipse Foundation Theia >= 1.8.1, < 1.73.0
Timeline
- 2026-03-11: other: Vulnerability reproduction and verification by researcher.
- 2026-07-03: advisory: Public disclosure of GHSA-78g8-vm3p-97c6 and CVE-2026-10054.
- 2026-07-03: patched: Fix released in version 1.73.0.