What’s Vulnerable › Vulnerabilities
CVE-2026-44691
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-18 · updated 2026-10-26
- Weakness: CWE-829
Description
In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user's privileges. In combination with AI chat features and a workspace .theia/settings.json that disabled tool confirmation, this could be triggered automatically by sending a message in the AI chat.
Affected products
- Eclipse Foundation Eclipse Theia: before 1.69.0 — fixed in 1.69.0
How to fix
Upgrade to a fixed version: Eclipse Foundation Eclipse Theia 1.69.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-44691 or the next vulnerability affects your stack