Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Eclipse Theia 1.74.0 Clear all filters
TI-2026-44283 CVE-2026-61891 · GHSA-xrrm-6636-87r2

Information disclosure in Eclipse Theia

Priority MEDIUM 40

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert a client-supplied URI directly to a file…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00533 Published 2026-08-05 Fixed in 1.74.0 CWE-200
TI-2026-42788 CVE-2026-60009 · GHSA-2mw2-h8hj-xpjg

Path traversal in Eclipse Theia

Priority MEDIUM 40

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00444 Published 2026-08-05 Fixed in 1.74.0 CWE-22
TI-2026-10807 CVE-2026-12609 · GHSA-34gw-v4cc-pv7c

Path traversal in Eclipse Theia

Priority MEDIUM 42

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(loca…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01644 Published 2026-08-05 Fixed in 1.74.0 CWE-22
TI-2026-12294 CVE-2026-14574 · GHSA-5f8h-2xph-wwxv

Prototype pollution in Eclipse Theia

Priority MEDIUM 59

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values without rejecting prototype-related keys (`__proto__`, `constructo…

CVSS 4.0MEDIUM 5.7 Local No auth User interaction EPSS 0.00395 Published 2026-08-05 Fixed in 1.74.0 CWE-1321