Is CVE-2026-22551 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22551 being exploited in the wild.

How severe is CVE-2026-22551?

Medium severity, with a CVSS score of 4, published 18 June 2026.

Which products and versions are affected?

Eclipse Foundation Theia < 1.71.0; @theia/ai-chat (npm) < 1.71.0, SEMVER:introduced=0,fixed=1.71.0; @theia/ai-chat-ui (npm) < 1.71.0, SEMVER:introduced=0,fixed=1.71.0; @theia/ai-claude-code (npm) < 1.71.0, SEMVER:introduced=0,fixed=1.71.0; and 4 more.

Is there a fix for CVE-2026-22551?

Yes. @theia/ai-chat (npm): upgrade to 1.71.0 or later; @theia/ai-chat-ui (npm): upgrade to 1.71.0 or later; @theia/ai-claude-code (npm): upgrade to 1.71.0 or later; @theia/ai-code-completion (npm): upgrade to 1.71.0 or later; @theia/ai-core (npm): upgrade to 1.71.0 or later; @theia/ai-editor (npm): upgrade to 1.71.0 or later; @theia/ai-ide (npm): upgrade to 1.71.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-22551 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-22551?

Check whether you run Eclipse Foundation Theia, @theia/ai-chat (npm), @theia/ai-chat-ui (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22551: Eclipse Theia data exfiltration via Markdown image rendering in AI chat

Q: Is there a fix for CVE-2026-22551?

Yes. @theia/ai-chat (npm): upgrade to 1.71.0 or later; @theia/ai-chat-ui (npm): upgrade to 1.71.0 or later; @theia/ai-claude-code (npm): upgrade to 1.71.0 or later; @theia/ai-code-completion (npm): upgrade to 1.71.0 or later; @theia/ai-core (npm): upgrade to 1.71.0 or later; @theia/ai-editor (npm): upgrade to 1.71.0 or later; @theia/ai-ide (npm): upgrade to 1.71.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-22551 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-22551?

Check whether you run Eclipse Foundation Theia, @theia/ai-chat (npm), @theia/ai-chat-ui (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22551 · Severity: medium · CVSS 4 · Published 2026-06-18

Eclipse Theia is an open-source framework used to build integrated development environments (IDEs) like VS Code. A vulnerability in its AI chat feature allows a malicious workspace to trick the AI into sending sensitive project data or conversation history to an external server controlled by an attacker. This could result in the theft of proprietary source code or confidential information when a developer opens a compromised project.

Technologies: Eclipse Foundation Theia, @theia/ai-chat (npm), @theia/ai-chat-ui (npm), @theia/ai-claude-code (npm), @theia/ai-code-completion (npm), @theia/ai-core (npm), @theia/ai-editor (npm). Vendors: Eclipse Foundation, npm.

Quick answers

Is CVE-2026-22551 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22551 being exploited in the wild.
How severe is CVE-2026-22551?: Medium severity, with a CVSS score of 4, published 18 June 2026.
Which products and versions are affected?: Eclipse Foundation Theia < 1.71.0; @theia/ai-chat (npm) < 1.71.0, SEMVER:introduced=0,fixed=1.71.0; @theia/ai-chat-ui (npm) < 1.71.0, SEMVER:introduced=0,fixed=1.71.0; @theia/ai-claude-code (npm) < 1.71.0, SEMVER:introduced=0,fixed=1.71.0; and 4 more.
Is there a fix for CVE-2026-22551?: Yes. @theia/ai-chat (npm): upgrade to 1.71.0 or later; @theia/ai-chat-ui (npm): upgrade to 1.71.0 or later; @theia/ai-claude-code (npm): upgrade to 1.71.0 or later; @theia/ai-code-completion (npm): upgrade to 1.71.0 or later; @theia/ai-core (npm): upgrade to 1.71.0 or later; @theia/ai-editor (npm): upgrade to 1.71.0 or later; @theia/ai-ide (npm): upgrade to 1.71.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22551 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-22551?: Check whether you run Eclipse Foundation Theia, @theia/ai-chat (npm), @theia/ai-chat-ui (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@theia/ai-chat (npm): upgrade to 1.71.0 or later
```
npm install @theia/ai-chat@1.71.0
```
@theia/ai-chat-ui (npm): upgrade to 1.71.0 or later
```
npm install @theia/ai-chat-ui@1.71.0
```
@theia/ai-claude-code (npm): upgrade to 1.71.0 or later
```
npm install @theia/ai-claude-code@1.71.0
```
@theia/ai-code-completion (npm): upgrade to 1.71.0 or later
```
npm install @theia/ai-code-completion@1.71.0
```
@theia/ai-core (npm): upgrade to 1.71.0 or later
```
npm install @theia/ai-core@1.71.0
```
@theia/ai-editor (npm): upgrade to 1.71.0 or later
```
npm install @theia/ai-editor@1.71.0
```
@theia/ai-ide (npm): upgrade to 1.71.0 or later
```
npm install @theia/ai-ide@1.71.0
```

Technical details

A data exfiltration vulnerability exists in Eclipse Theia's AI chat component due to improper neutralization of sensitive information in sent data (CWE-201) and the inclusion of functionality from an untrusted control sphere (CWE-829). The AI chat rendered Markdown image tags from AI responses without restriction, allowing the triggering of HTTP requests to arbitrary external URLs. By using prompt injection within a malicious workspace, an attacker can force the AI agent to embed sensitive workspace data or conversation context into the query parameters of an image URL. When the IDE renders the chat response, it automatically performs a GET request to the attacker's server, leaking the data. The issue is mitigated in version 1.71.0 through the introduction of workspace trust enforcement, which disables AI features in untrusted workspaces.

Affected products

Eclipse Foundation Eclipse Theia < 1.71.0

Identifiers

CVE-2026-22551
GHSA-qwjm-9c66-w4q4

Timeline

2026-06-18: advisory: NVD publication date
2026-06-18: disclosed: CVE published by Eclipse Foundation

References

https://gitlab.eclipse.org/security/cve-assignment/-/work_items/115

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.