Read the docs
TI-2019-13161 Aliases CVE-2019-17636GHSA-f7vx-j8mp-3h2x

Insufficient verification of data authenticity in Eclipse Theia

Priority LOW 36CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-345.

Summary

In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of files on the host's filesystem, given their path, without restrictions on the requester's origin. This design is vulnerable to being exploited remotely through a DNS rebinding attack or a drive-by download of a carefully crafted exploit.

Why it matters now

EPSS 0.00601 48th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed @theia/mini-browser (npm): 0.16.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Theia0.3.9 to 0.15.0—No fix listedCNA
—@theia/mini-browser (npm)0.3.9 to before 0.16.00.16.0Patch availableGHSA-f7vx-j8mp-3h2x
  • Eclipse Theia VendorEclipse Foundation Affected 0.3.9 to 0.15.0 Fixed in — No fix listed CNA
  • @theia/mini-browser (npm) Vendor— Affected 0.3.9 to before 0.16.0 Fixed in 0.16.0 Patch available GHSA-f7vx-j8mp-3h2x

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:*0.3.9 – 0.15.0VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:theia:*:*:*:*:*:*:*:* Versions 0.3.9 – 0.15.0 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · GHSA-f7vx-j8mp-3h2x @theia/mini-browser (npm) Fixed in 0.16.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-17636
  2. 2026-10-03 Alias added: GHSA-f7vx-j8mp-3h2x

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-12294 Prototype pollution in Eclipse Theia CVSS 4.0MEDIUM 5.7
  • TI-2021-13470 Path traversal in Eclipse Theia CVSS 3.1CRITICAL 9.8
  • TI-2020-16550 Cross-site scripting in Eclipse Theia CVSS 3.1CRITICAL 9.6
  • TI-2026-10807 Path traversal in Eclipse Theia CVSS 3.1HIGH 7.5
  • TI-2026-44283 Information disclosure in Eclipse Theia CVSS 3.1HIGH 7.5
  • TI-2026-42788 Path traversal in Eclipse Theia CVSS 3.1HIGH 8.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences