CVE-2026-46580: Eclipse Theia indirect prompt injection in AI agent system prompts

CVE-2026-46580 · Severity: high · CVSS 4 · Published 2026-06-18

Eclipse Theia, a platform for building cloud and desktop IDEs, contains a vulnerability in its AI chat integration. An attacker can create a malicious project repository that, when opened by a user, automatically overrides the AI's internal instructions. This can be used to trick the AI into stealing sensitive data or executing unauthorized commands on the user's computer.

Technologies: Eclipse Foundation Theia, @theia/ai-chat (npm), @theia/ai-chat-ui (npm), @theia/ai-claude-code (npm), @theia/ai-code-completion (npm), @theia/ai-core (npm), @theia/ai-editor (npm). Vendors: Eclipse Foundation, npm.

Quick answers

Is CVE-2026-46580 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46580 being exploited in the wild.
How severe is CVE-2026-46580?
High severity, with a CVSS score of 4, published 18 June 2026.
Which products and versions are affected?
Eclipse Foundation Theia < 1.71.0; @theia/ai-chat (npm) < 1.71.0, SEMVER:introduced=0,fixed=1.71.0; @theia/ai-chat-ui (npm) < 1.71.0, SEMVER:introduced=0,fixed=1.71.0; @theia/ai-claude-code (npm) < 1.71.0, SEMVER:introduced=0,fixed=1.71.0; and 3 more.
Is there a fix for CVE-2026-46580?
Yes. @theia/ai-chat (npm): upgrade to 1.71.0 or later; @theia/ai-chat-ui (npm): upgrade to 1.71.0 or later; @theia/ai-claude-code (npm): upgrade to 1.71.0 or later; @theia/ai-code-completion (npm): upgrade to 1.71.0 or later; @theia/ai-core (npm): upgrade to 1.71.0 or later; @theia/ai-editor (npm): upgrade to 1.71.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46580 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-46580?
Check whether you run Eclipse Foundation Theia, @theia/ai-chat (npm), @theia/ai-chat-ui (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @theia/ai-chat (npm): upgrade to 1.71.0 or later
    npm install @theia/ai-chat@1.71.0
  • @theia/ai-chat-ui (npm): upgrade to 1.71.0 or later
    npm install @theia/ai-chat-ui@1.71.0
  • @theia/ai-claude-code (npm): upgrade to 1.71.0 or later
    npm install @theia/ai-claude-code@1.71.0
  • @theia/ai-code-completion (npm): upgrade to 1.71.0 or later
    npm install @theia/ai-code-completion@1.71.0
  • @theia/ai-core (npm): upgrade to 1.71.0 or later
    npm install @theia/ai-core@1.71.0
  • @theia/ai-editor (npm): upgrade to 1.71.0 or later
    npm install @theia/ai-editor@1.71.0

Technical details

Eclipse Theia versions prior to 1.71.0 are vulnerable to indirect prompt injection. The application automatically loads workspace files matching the `.prompts/*.prompttemplate` pattern and uses them to define or extend the AI agent's system prompts without sufficient isolation. By crafting a malicious repository, an attacker can gain control over the AI's instructions when a user opens the workspace. This can be chained with other features to achieve data exfiltration via Markdown image rendering or arbitrary command execution through task definitions. The issue is addressed in version 1.71.0.

Affected products

  • Eclipse Foundation Theia < 1.71.0

Identifiers

  • CVE-2026-46580
  • GHSA-m973-pr9r-hp2w

Timeline

  • 2026-06-18: advisory: Initial disclosure by Eclipse Foundation
  • 2026-06-18: patched: Fix released in version 1.71.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.