Known Vulnerabilities for Eclipse Theia by Eclipse Foundation
Listed below are 10 of the newest known vulnerabilities associated with "Eclipse Theia" by "Eclipse Foundation".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-82217 json | In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, sug... | Not Provided | 2026-08-31 | 2026-09-01 |
| CVE-2026-61891 json | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`... | Not Provided | 2026-08-05 | 2026-08-05 |
| CVE-2026-60009 json | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every file... | Not Provided | 2026-08-05 | 2026-08-05 |
| CVE-2026-59326 json | The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variable ... | Not Provided | 2026-07-30 | 2026-07-30 |
| CVE-2026-47858 json | Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vu... | Not Provided | 2026-07-30 | 2026-08-01 |
| CVE-2026-19884 json | In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring th... | Not Provided | 2026-08-14 | 2026-08-17 |
| CVE-2026-14574 json | In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursiv... | Not Provided | 2026-08-05 | 2026-08-05 |
| CVE-2026-12609 json | In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:p... | Not Provided | 2026-08-05 | 2026-08-05 |
| CVE-2026-10055 json | In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any ... | Not Provided | 2026-07-03 | 2026-07-06 |
| CVE-2026-10054 json | In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (... | Not Provided | 2026-07-03 | 2026-07-07 |