CVE-2026-46580: Eclipse Theia AI Prompt Injection – Patch to 1.71.0

Technical summary

CVE-2026-46580 is an indirect prompt injection vulnerability in Eclipse Theia versions before 1.71.0. The application automatically deserializes and loads prompt template files matching `.prompts/*.prompttemplate` from workspace directories without validation or sandboxing. An attacker can craft a repository containing malicious prompt templates that override system prompts for Theia's integrated AI chat agent. The vulnerability is particularly dangerous because it operates at the workspace level—requiring only that a user open a repository—and can be combined with Markdown image rendering in chat responses (enabling data exfiltration) or task definition execution (enabling command injection) to achieve material harm.

Business impact

For organizations using Theia for collaborative development or in cloud-based IDEs, this vulnerability creates a supply-chain attack vector. Developers who clone repositories from untrusted sources risk having their AI assistant compromised, potentially leading to credential leakage, intellectual property theft via exfiltrated code snippets, or lateral movement through arbitrary command execution. Teams relying on AI chat for code completion or documentation are especially exposed, as the AI's corrupted instructions may transparently perform malicious actions. The attack requires minimal user interaction (opening a workspace) and leaves minimal forensic traces, making it a significant risk in open-source and third-party code integration workflows.

Affected systems

All versions of Eclipse Theia prior to 1.71.0 are affected. This includes Theia deployments in development environments, cloud IDEs, and remote development setups. Organizations using Theia as a component in custom IDE builds or SaaS offerings should verify their Theia version and apply patches immediately.

Exploitability

Exploitability is high. The attack requires only network access (AV:N), no special privileges (PR:N), and minimal user interaction—a developer merely opening a workspace (UI:R). The attack surface is broad because prompt template loading happens automatically without user confirmation. No exploit code or advanced techniques are needed; a static malicious repository is sufficient. However, maximum impact requires chaining with secondary features (AI chat, Markdown rendering, task execution), which slightly lowers the bar for casual exploitation but remains feasible for motivated attackers.

Remediation

Upgrade Eclipse Theia to version 1.71.0 or later. The patch restricts automatic loading and validation of prompt template files, mitigating the indirect injection attack. Organizations should also implement workspace trust controls if available, audit repositories for `.prompts/` directories before opening them, and consider restricting AI chat features in untrusted environments. For teams unable to upgrade immediately, disable AI chat plugins or restrict Theia's task execution features as a compensating control.

Patch guidance

Eclipse Theia 1.71.0 includes mitigations for prompt template injection. Apply this update across all Theia deployments, including cloud IDE instances and custom Theia builds. Verify patch installation by checking the version in Theia's about dialog or via the CLI (`theia --version`). After patching, verify that `.prompts/` directories in existing workspaces are no longer automatically loaded without user action. Test with a repository containing prompt templates to confirm the fix is effective.

Detection guidance

Monitor workspace configuration files and audit logs for the presence of `.prompts/*.prompttemplate` files in repositories, especially those from external or untrusted sources. In development environments, inspect Theia's AI agent output for unexpected behavioral changes or prompt prefix modifications. Log and alert on any automatic loading of prompt templates from workspace-local directories. For forensic investigation, check Theia's configuration state and workspace metadata for evidence of prompt overrides. Network-based detection is limited; focus on endpoint telemetry and workspace scanning.

Why prioritize this

This vulnerability merits immediate prioritization due to its CVSS 8.8 (HIGH) severity, low attack complexity, and minimal user friction. The combination of indirect prompt injection with secondary attack chains (data exfiltration, command execution) amplifies impact. While it requires user interaction (opening a repository), this is a routine developer action, making the barrier to exploitation very low. Organizations with active Theia deployments, especially those supporting open-source or third-party code review, should prioritize patching within 7–14 days.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability (C:H/I:H/A:H) combined with a low attack vector (network-accessible, no privileges required). The primary mitigating factor is user interaction (UI:R), but this is a low bar—opening a workspace is a daily developer action. The absence of scope change (S:U) indicates the attack does not escape the context of the Theia application, but chaining with task execution or Markdown rendering can effectively escalate scope. The score appropriately captures the severity for development environments, though risk varies by deployment context (higher in cloud IDEs, lower in isolated local instances).

Frequently asked questions