Executive brief
Eclipse Theia is an open-source framework used to build integrated development environments (IDEs) like VS Code. A vulnerability in its AI chat feature allows a malicious workspace to trick the AI into sending sensitive project data or conversation history to an external server controlled by an attacker. This could result in the theft of proprietary source code or confidential information when a developer opens a compromised project.
Technical details
A data exfiltration vulnerability exists in Eclipse Theia's AI chat component due to improper neutralization of sensitive information in sent data (CWE-201) and the inclusion of functionality from an untrusted control sphere (CWE-829). The AI chat rendered Markdown image tags from AI responses without restriction, allowing the triggering of HTTP requests to arbitrary external URLs. By using prompt injection within a malicious workspace, an attacker can force the AI agent to embed sensitive workspace data or conversation context into the query parameters of an image URL. When the IDE renders the chat response, it automatically performs a GET request to the attacker's server, leaking the data. The issue is mitigated in version 1.71.0 through the introduction of workspace trust enforcement, which disables AI features in untrusted workspaces.
Affected products
- Eclipse Foundation Eclipse Theia < 1.71.0
Timeline
- 2026-06-18: advisory: NVD publication date
- 2026-06-18: disclosed: CVE published by Eclipse Foundation