CVE-2026-22551: Eclipse Theia AI Chat Information Disclosure via Markdown Rendering

Technical summary

The vulnerability stems from insufficient URL validation in Theia's AI chat markdown renderer. When the AI generates a response containing markdown image syntax (), the client-side renderer processes the URL without filtering or restriction on the scheme or domain. An attacker can craft a prompt injection within a workspace configuration or task that causes the AI agent to embed sensitive data—gathered from the workspace file tree, recent conversation context, or environment metadata—into a crafted image URL. The browser then initiates an HTTP(S) request to that URL, leaking the encoded data in the request itself (as part of the query string or path). CWE-201 (Exposure of Sensitive Information Through an Error Message) and CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) both apply: the markdown renderer trusts AI-generated content without validation, and it executes requests controlled by untrusted input. Versions 1.71.0 and later mitigate the attack by enforcing workspace trust checks that disable AI features in untrusted workspaces, preventing the prompt injection step.

Business impact

For development teams using Theia as their primary IDE—particularly those integrating it into cloud development environments or using it for distributed or remote coding—this vulnerability creates a data exfiltration risk. If developers regularly open workspaces shared by colleagues, from public repositories, or from CI/CD pipelines without verifying trust, an attacker can silently harvest environment variables, credentials stored in workspace files, intellectual property in source code, or other context available to the AI chat. The impact is not system-wide compromise, but rather targeted information theft that could expose credentials, API keys, or proprietary algorithms. Organizations with strict data classification policies or those subject to compliance regimens (HIPAA, PCI-DSS, SOC 2) should treat this as a containment priority to prevent accidental exfiltration of regulated data.

Affected systems

Eclipse Theia versions prior to 1.71.0 are vulnerable. The vulnerability requires the user to have AI chat enabled and to open or interact with an untrusted workspace while using that feature. Organizations running self-hosted Theia instances, cloud-based Theia services (such as IDEs built on Theia), or Theia integrated into development platforms should verify their deployed version. Version 1.71.0 and later include workspace trust enforcement that blocks the attack vector.

Exploitability

Exploitability is moderate. An attacker must craft a prompt injection within a workspace (e.g., in a .theia config file, a task definition, or repository content) or socially engineer a user to paste a malicious prompt into the chat. The victim must then open that workspace and interact with the AI chat feature. No network access, authentication bypass, or system-level privilege escalation is required—this is a client-side vulnerability triggered by user interaction. However, because it relies on user action and workspace opening, it is not a remote code execution or zero-click scenario. The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects that any network user can set up the attack, with low complexity, but user interaction is mandatory.

Remediation

Upgrade Eclipse Theia to version 1.71.0 or later. This version introduces workspace trust controls that disable AI features in untrusted workspaces, preventing the prompt injection attack chain from executing. Organizations should also review workspace sources: avoid opening workspaces from untrusted or unverified sources, and consider restricting AI chat to trusted workspaces only via policy or configuration. For users who must work with potentially untrusted workspaces, disabling or limiting AI chat features reduces surface area.

Patch guidance

Upgrade all Eclipse Theia instances to 1.71.0 or later. Verify the deployed version via the Theia about/version dialog or by checking the package.json or release notes of your deployment. If you are running Theia in a containerized environment, ensure container images are rebuilt and redeployed with the patched version. If Theia is integrated into a larger platform (e.g., a cloud IDE service), verify with your vendor that they have released a patched version and follow their update guidance. No configuration changes are required post-patch; workspace trust enforcement activates automatically.

Detection guidance

Monitor for suspicious HTTP requests originating from Theia client instances to external or unexpected domains during AI chat sessions. Enable request logging at the proxy or firewall level to catch exfiltration attempts. Analyze Theia logs for AI chat interactions involving URLs or suspicious prompts; though Theia does not log rendered markdown by default, correlating network activity with chat timestamps may reveal attacks. If you have access to workspace configuration files, scan for prompt injection patterns in .theia/tasks.json or similar files. Additionally, check for unauthorized or suspicious workspace trust policy changes that might lower security posture.

Why prioritize this

This vulnerability merits prompt patching because it enables silent, targeted data exfiltration without alerting the user or leaving obvious forensic traces. Unlike a crash or obvious malfunction, the attack is stealthy—the user may not realize sensitive data has been stolen. Organizations handling source code, credentials, or sensitive data in workspaces should prioritize upgrade to 1.71.0. However, the requirement for user interaction (opening a workspace and using AI chat) prevents it from being critical; it does not spread laterally or persist on its own. Medium severity and moderate exploitability justify treatment as a high-priority but not emergency patch, unless your organization has widespread Theia adoption or uses it for highly sensitive projects.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects high confidentiality impact (C:H)—sensitive information can be exfiltrated—but no integrity or availability impact. Attack vector is network (any user can host a malicious workspace or prompt), attack complexity is low (no special conditions required), no privileges are needed, but user interaction is required (opening the workspace). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N correctly captures a silent information disclosure vulnerability with broad attack surface but mandatory user involvement. The absence of KEV status (not yet in CISA Catalog) suggests active exploitation has not been widely documented as of the data publication date, but organizations should not interpret this as low real-world risk given the simplicity of the attack.

Frequently asked questions