CVE Explorer

CVE-2026-44688

In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository with adversarial directory or file names that, when analyzed by the AI agent, would cause the agent to follow attacker-controlled instructions (indirect prompt injection). Combined with other AI chat features available in untrusted workspaces, this enabled attack

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:458df12c1ddfa3f09233d3251407336b8156732a89666611b1005a4b4886773d

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-1427","description":"CWE-1427 Improper neutralization of input used for LLM prompting","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:5f9ee090215dc8b0e735a1d123f2e00c69b7eae46d479dd8fdcd1f47db835db7 · sha256:62e412a2efa12104… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-829","description":"CWE-829 Inclusion of functionality from untrusted control sphere","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:5f9ee090215dc8b0e735a1d123f2e00c69b7eae46d479dd8fdcd1f47db835db7 · sha256:62e412a2efa12104… · /containers/cna/problemTypes/1/descriptions/0

Affected products and versions

1 source assertion

{"defaultStatus":"unaffected","product":"Eclipse Theia","repo":"https://github.com/eclipse-theia/theia","vendor":"Eclipse Foundation","versions":[{"lessThan":"1.71.0","status":"affected","version":"0","versionType":"semver"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:5f9ee090215dc8b0e735a1d123f2e00c69b7eae46d479dd8fdcd1f47db835db7 · sha256:62e412a2efa12104… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":8.4,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"…

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:5f9ee090215dc8b0e735a1d123f2e00c69b7eae46d479dd8fdcd1f47db835db7 · sha256:62e412a2efa12104… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

2 source assertions

{"cweId":"CWE-1427","description":"CWE-1427 Improper neutralization of input used for LLM prompting","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:5f9ee090215dc8b0e735a1d123f2e00c69b7eae46d479dd8fdcd1f47db835db7 · sha256:62e412a2efa12104… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-829","description":"CWE-829 Inclusion of functionality from untrusted control sphere","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:5f9ee090215dc8b0e735a1d123f2e00c69b7eae46d479dd8fdcd1f47db835db7 · sha256:62e412a2efa12104… · /containers/cna/problemTypes/1/descriptions/0

Source references

1 source assertion

{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/113"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:5f9ee090215dc8b0e735a1d123f2e00c69b7eae46d479dd8fdcd1f47db835db7 · sha256:62e412a2efa12104… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer