CyberRota Analysis
AI-GeneratedEclipse Theia versions 1.73.0 to 1.74.9 are vulnerable due to insufficient workspace containment checks in the AI "Agent Mode" file-change tools, allowing attackers to manipulate file paths and write or delete files outside the intended workspace. This vulnerability can lead to unauthorized file modifications, including critical files like shell startup scripts or SSH keys, potentially resulting in code execution with the privileges of the backend OS user. Organizations using affected versions of Eclipse Theia should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replacement and state helpers) resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc, an absolute path, or a ~-expanded path could therefore write or delete files outside the workspace with the privileges of the Theia backend OS user. Because the path argument is influenced by model output, it can be steered through indirect prompt injection, and in Agent Mode writes are applied without a confirmation dialog. Writing to a host-executed file such as a shell startup file or ~/.ssh/authorized_keys can escalate to code execution on the backend.