Executive brief
Eclipse Theia is a cloud-based IDE framework that includes an AI "Agent Mode" feature allowing AI models to modify files in a workspace. The affected file-change tools fail to validate that file paths remain within the workspace boundary, allowing an attacker to write or delete arbitrary files on the backend server. By steering an AI agent with malicious prompts, an attacker can write to shell startup files or SSH configuration files, leading to remote code execution with the privileges of the Theia backend process.
Technical details
The vulnerability is a path traversal flaw in the AI Agent Mode's file-change tools (writeFileContent, suggestFileContent, writeFileReplacements, getProposedFileState, clearFileChanges). These tools call the raw path resolver (resolveRelativePath) without invoking containment checks, then directly write files via the file service sink with no further validation. An attacker can craft relative paths like "../.bashrc" or use absolute paths that escape the workspace. The path argument is attacker-controlled via indirect prompt injection: if an agent reads attacker-influenced content (repository files, issues, or fetched pages), it can be steered to emit malicious tool calls. In Agent Mode, writes are applied immediately without user confirmation. The fix exists in other resolvers (resolveToUri, ensureWithinWorkspace) but is not used by the vulnerable tools; version 1.75.0 adds mandatory containment checks via WorkspaceFunctionScope.resolveAccessiblePath.
Affected products
- Eclipse Theia 1.73.0 to 1.74.x
Timeline
- 2026-08-31: disclosed: Published on NVD
- 2026-08-11: patched: Fix merged via commit 28da106c2541b3bfecf676b60d655774809e4b6b, available in 1.75.0
- 2026-07-24: other: Vulnerability reported