Known Vulnerabilities for Eclipse Theia by Eclipse Foundation
Listed below are 10 of the newest known vulnerabilities associated with "Eclipse Theia" by "Eclipse Foundation".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-61891 json | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`... | Not Provided | 2026-08-05 | 2026-08-05 |
| CVE-2026-60009 json | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every file... | Not Provided | 2026-08-05 | 2026-08-05 |
| CVE-2026-59326 json | The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variable ... | Not Provided | 2026-07-30 | 2026-07-30 |
| CVE-2026-47858 json | Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vu... | Not Provided | 2026-07-30 | 2026-08-01 |
| CVE-2026-46580 json | In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatic... | Not Provided | 2026-06-18 | 2026-06-19 |
| CVE-2026-44691 json | In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.... | Not Provided | 2026-06-18 | 2026-06-19 |
| CVE-2026-44688 json | In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prom... | Not Provided | 2026-06-18 | 2026-06-19 |
| CVE-2026-22551 json | In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP reques... | Not Provided | 2026-06-18 | 2026-06-18 |
| CVE-2026-14574 json | In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursiv... | Not Provided | 2026-08-05 | 2026-08-05 |
| CVE-2026-12609 json | In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:p... | Not Provided | 2026-08-05 | 2026-08-05 |