CVE-2026-44688: Eclipse Theia AI Chat Prompt Injection – Arbitrary Code Execution Risk

Technical summary

CVE-2026-44688 is a prompt injection vulnerability in Eclipse Theia's AI chat agent. The vulnerability exists because the agent includes workspace file and directory names directly in its prompt context without sanitization or clear semantic separation from system-level instructions. An attacker can exploit this by creating a repository with adversarial filenames or directory names that, when processed by the AI agent, are interpreted as instructions rather than benign data. The attack is compounded by integration with other Theia features: Markdown image rendering can exfiltrate data via external image requests, and task definitions can achieve arbitrary command execution. The vulnerability affects Theia versions prior to 1.71.0 and requires user interaction (opening a repository) but does not require elevated privileges.

Business impact

This vulnerability poses a significant risk to development teams using Eclipse Theia with AI-assisted coding workflows. Threat actors can distribute trojanized repositories that compromise developer machines when opened, leading to theft of source code, API keys, credentials stored in the workspace, or environment variables. In supply chain scenarios, a compromised developer environment could facilitate lateral movement into broader organizational networks. The low barrier to exploitation—requiring only that a developer clone and open a malicious repository—makes this particularly dangerous in collaborative environments where developers routinely work with code from multiple sources.

Affected systems

Eclipse Theia versions prior to 1.71.0 are affected. The vulnerability is specifically triggered when the AI chat agent is active and processes workspace contents. Organizations running older versions of Theia or bundled Theia installations (such as in cloud IDEs or custom development environments) should verify their version against 1.71.0. Browser-based and desktop deployments of Theia are both in scope.

Exploitability

The vulnerability is readily exploitable with low complexity. An attacker needs only to create a repository with crafted filenames and distribute it (via GitHub, GitLab, or other code hosting platforms, or via social engineering). No special network access, authentication, or system-level privileges are required. User interaction is mandatory—a developer must clone and open the repository in Theia for the AI agent to process the malicious filenames—but this is a normal development workflow. The CVSS vector reflects this accessibility: network-based attack, low complexity, no privileges required, and user interaction present.

Remediation

Upgrade Eclipse Theia to version 1.71.0 or later. This version includes fixes that properly sanitize and contextualize file and directory names within AI chat prompts, preventing them from being interpreted as instructions. Organizations should also consider disabling AI chat features in Theia if they are not actively used, and educating developers about the risks of opening untrusted repositories in code editors with AI-assisted features enabled.

Patch guidance

Apply the upgrade to Eclipse Theia 1.71.0 or later as soon as possible. If you are using Theia as part of a larger platform (cloud IDE, container image, or customized distribution), verify with your vendor that they have updated their Theia dependencies. Test the upgrade in a non-production environment first to ensure compatibility with extensions and custom configurations. If immediate patching is not feasible, consider disabling the AI chat agent feature until the patch can be deployed.

Detection guidance

Monitor for access to Theia instances from suspicious or unexpected code repositories. Log and review any AI chat interactions that reference file or directory names containing unusual syntax, command-like patterns, or special characters that might indicate prompt injection attempts. If you have telemetry from Theia or IDE usage, look for unusual patterns in which workspaces are opened or analyzed. Endpoint detection and response (EDR) tools should monitor for unexpected command execution or process spawning originating from Theia or task execution contexts. Network monitoring can flag data exfiltration attempts via external image requests generated from Markdown rendering within AI chat outputs.

Why prioritize this

This vulnerability merits immediate attention due to its combination of high severity (CVSS 8.8), ease of exploitation, and direct impact on developer security. Unlike many supply chain risks, this does not require a compromised legitimate package—it exploits normal developer workflows. The potential for data exfiltration and arbitrary code execution makes it critical for any organization where developers use Theia with AI features. The lack of CISA KEV status should not reduce urgency; this is a recent disclosure with high real-world applicability.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: network-based attack vector (any internet-distributed repository can be malicious), low attack complexity (simple filename crafting), no privileges required, user interaction necessary (developer must open the repo), limited scope (confined to the affected system), and high impact across confidentiality, integrity, and availability (data theft, code execution, system compromise). The score accurately captures the severity while acknowledging that user action is required.

Frequently asked questions