CVE-2026-44691: Eclipse Theia Arbitrary Code Execution via Untrusted Task Execution

Technical summary

The vulnerability stems from insufficient trust validation when loading task definitions from .theia/tasks.json or .vscode/tasks.json files. Theia does not enforce workspace trust before executing these tasks, allowing arbitrary command execution. The attack surface expands when combined with AI chat integration: if workspace settings disable tool confirmation prompts (via configuration in .theia/settings.json), an attacker-controlled AI message can trigger task execution without additional user interaction. The flaw is classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere).

Business impact

Organizations using Theia as a development environment face supply-chain risk when developers work with untrusted repositories. A compromised or malicious repository can execute code with developer privileges, potentially stealing credentials, injecting malware into the build pipeline, or modifying source code. The AI chat acceleration path significantly lowers the friction required for successful exploitation, making this particularly dangerous in collaborative environments where repositories are frequently shared or cloned from public sources.

Affected systems

Eclipse Theia versions prior to 1.69.0 are vulnerable. All installations, regardless of OS, are affected since the vulnerability is in the core task execution logic. Exposure is highest for teams using Theia with AI chat features enabled and workspaces that inherit or configure reduced confirmation prompts.

Exploitability

Exploitation requires moderate effort: an attacker must craft a repository with malicious task definitions and distribute it (e.g., via public repository, social engineering, or supply-chain compromise). The attack then requires a user to clone and open the repository in Theia. The AI chat trigger path eliminates the need for manual task invocation, reducing user friction and increasing likelihood of success. No authentication or special privileges are required from the attacker's perspective.

Remediation

Upgrade Eclipse Theia to version 1.69.0 or later. This release implements workspace trust verification for task execution, blocking automatic execution of untrusted tasks. Organizations should also audit workspace configurations to identify and remove any settings that disable tool confirmation prompts in AI chat features. Implement repository scanning and code review practices to catch malicious task definitions before they reach developers.

Patch guidance

Apply the upgrade to Theia 1.69.0 at your earliest convenience given the HIGH severity rating. Verify the upgrade in test environments first, particularly if your organization customizes task definitions or relies on specific AI chat workflows. After patching, developers may see new prompts requesting workspace trust; document this change to avoid confusion during rollout. Check the Eclipse Theia release notes for any breaking changes related to task execution behavior.

Detection guidance

Monitor for unexpected task execution in Theia logs, particularly tasks originating from .theia/tasks.json or .vscode/tasks.json in recently-cloned repositories. Watch for AI chat messages that reference task execution or tool invocation in workspaces with disabled confirmation settings. Endpoint detection tools should flag command execution originating from Theia runtime processes, especially commands that access credential stores, modify source files, or execute network requests. Review repository commit history for suspicious task definitions added in malicious branches.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (8.8), low attack complexity, and no required authentication. The AI chat automation path significantly lowers the barrier to exploitation compared to manual task invocation. Development environments are high-value targets that often maintain access to sensitive credentials, source code, and build infrastructure. The risk is amplified in organizations where developers routinely work with external or community repositories.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: network-based attack vector (developers opening repositories from any source), low attack complexity (standard Git clone and open action), no privileges or authentication required, and high impact across confidentiality, integrity, and availability (arbitrary code execution under user privileges). The score does not account for supply-chain amplification or AI chat automation, which elevate real-world risk beyond the base metric.

Frequently asked questions