# CVE-2026-44688: Eclipse Theia indirect prompt injection in AI chat agent

Source: https://junglewise.ai/threats/cve-2026-44688-eclipse-theia-indirect-prompt-injection-in-ai-chat-agent  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-44688 · Severity: high · CVSS 4 · Published 2026-06-18

Eclipse Theia is a cloud and desktop IDE framework that includes AI-powered chat and code completion features. An attacker can craft a malicious repository with specially crafted file and directory names that trick the AI chat agent into executing unintended instructions. This could lead to sensitive data exposure or arbitrary command execution when developers open untrusted projects.

Technologies: [Eclipse Foundation Theia](https://junglewise.ai/threats/technologies/theia), [@theia/ai-chat (npm)](https://junglewise.ai/threats/technologies/theia-ai-chat), [@theia/ai-chat-ui (npm)](https://junglewise.ai/threats/technologies/theia-ai-chat-ui), [@theia/ai-claude-code (npm)](https://junglewise.ai/threats/technologies/theia-ai-claude-code), [@theia/ai-code-completion (npm)](https://junglewise.ai/threats/technologies/theia-ai-code-completion), [@theia/ai-core (npm)](https://junglewise.ai/threats/technologies/theia-ai-core), [@theia/ai-editor (npm)](https://junglewise.ai/threats/technologies/theia-ai-editor). Vendors: [Eclipse Foundation](https://junglewise.ai/threats/vendors/eclipse-foundation), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-44688 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44688 being exploited in the wild.

**How severe is CVE-2026-44688?** High severity, with a CVSS score of 4, published 18 June 2026.

**Which products and versions are affected?** Eclipse Foundation Theia < 1.71.0; @theia/ai-chat (npm) < 1.71.0, SEMVER:introduced=0,fixed=1.71.0; @theia/ai-chat-ui (npm) < 1.71.0, SEMVER:introduced=0,fixed=1.71.0; @theia/ai-claude-code (npm) < 1.71.0, SEMVER:introduced=0,fixed=1.71.0; and 4 more.

**Is there a fix for CVE-2026-44688?** Yes. @theia/ai-chat (npm): upgrade to 1.71.0 or later; @theia/ai-chat-ui (npm): upgrade to 1.71.0 or later; @theia/ai-claude-code (npm): upgrade to 1.71.0 or later; @theia/ai-code-completion (npm): upgrade to 1.71.0 or later; @theia/ai-core (npm): upgrade to 1.71.0 or later; @theia/ai-editor (npm): upgrade to 1.71.0 or later; @theia/ai-ide (npm): upgrade to 1.71.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44688 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-44688?** Check whether you run Eclipse Foundation Theia, @theia/ai-chat (npm), @theia/ai-chat-ui (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @theia/ai-chat (npm): upgrade to 1.71.0 or later

  ```sh
  npm install @theia/ai-chat@1.71.0
  ```

- @theia/ai-chat-ui (npm): upgrade to 1.71.0 or later

  ```sh
  npm install @theia/ai-chat-ui@1.71.0
  ```

- @theia/ai-claude-code (npm): upgrade to 1.71.0 or later

  ```sh
  npm install @theia/ai-claude-code@1.71.0
  ```

- @theia/ai-code-completion (npm): upgrade to 1.71.0 or later

  ```sh
  npm install @theia/ai-code-completion@1.71.0
  ```

- @theia/ai-core (npm): upgrade to 1.71.0 or later

  ```sh
  npm install @theia/ai-core@1.71.0
  ```

- @theia/ai-editor (npm): upgrade to 1.71.0 or later

  ```sh
  npm install @theia/ai-editor@1.71.0
  ```

- @theia/ai-ide (npm): upgrade to 1.71.0 or later

  ```sh
  npm install @theia/ai-ide@1.71.0
  ```


## Technical details

The vulnerability is an indirect prompt injection (CWE-1427, CWE-829) in Eclipse Theia's AI chat feature. The root cause is that workspace file and directory names are included in the AI agent's prompt context without distinction from legitimate system instructions. An attacker who controls repository content can create adversarial directory or file names that, when processed by the AI agent, cause it to follow injected instructions. The attack requires opening an untrusted workspace and interacting with AI features; no authentication is required. Successful exploitation can lead to arbitrary command execution through task definition manipulation or sensitive data exfiltration via externally rendered Markdown images in AI chat output. The fix (version 1.71.0+) integrates workspace trust controls into AI features, preventing template loading and variable resolution in untrusted workspaces and gating AI execution on workspace trust status.

## Affected products

- Eclipse Theia < 1.71.0
- Eclipse @theia/ai-chat-ui < 1.71.0
- Eclipse @theia/ai-chat < 1.71.0
- Eclipse @theia/ai-claude-code < 1.71.0
- Eclipse @theia/ai-code-completion < 1.71.0
- Eclipse @theia/ai-core < 1.71.0
- Eclipse @theia/ai-editor < 1.71.0
- Eclipse @theia/ai-ide < 1.71.0

## Identifiers

- CVE-2026-44688
- GHSA-3jww-hxqj-wfq2

## Timeline

- 2026-06-18: disclosed: Advisory published
- 2026-04-28: patched: Fix merged in version 1.71.0 (PR #17364)

## References

- [https://github.com/eclipse-theia/theia/issues/16892](https://github.com/eclipse-theia/theia/issues/16892)
- [https://github.com/eclipse-theia/theia/pull/17364](https://github.com/eclipse-theia/theia/pull/17364)
- [https://github.com/eclipse-theia/theia/commit/e3fdfe6992389bc5fa611058d00c39d7408508ed](https://github.com/eclipse-theia/theia/commit/e3fdfe6992389bc5fa611058d00c39d7408508ed)
- [https://github.com/eclipse-theia/theia](https://github.com/eclipse-theia/theia)
- [https://gitlab.eclipse.org/security/cve-assignment/-/work_items/113](https://gitlab.eclipse.org/security/cve-assignment/-/work_items/113)

## Related threats

- [Eclipse Theia SSRF in request-service RPC](https://junglewise.ai/threats/cve-2026-10055-eclipse-theia-ssrf-in-request-service-rpc)
- [Eclipse Theia remote command execution via cross-origin WebSocket access](https://junglewise.ai/threats/cve-2026-10054-eclipse-theia-remote-command-execution-via-cross-origin-websocket)
- [Eclipse Theia indirect prompt injection in AI agent system prompts](https://junglewise.ai/threats/cve-2026-46580-eclipse-theia-indirect-prompt-injection-in-ai-agent-system)
- [Eclipse Theia arbitrary command execution via untrusted workspace tasks](https://junglewise.ai/threats/cve-2026-44691-eclipse-theia-arbitrary-command-execution-via-untrusted-workspace)
- [Eclipse Theia data exfiltration via Markdown image rendering in AI chat](https://junglewise.ai/threats/cve-2026-22551-eclipse-theia-data-exfiltration-via-markdown-image-rendering-in)