Source Control Integration Weakness in Eclipse Theia by Eclipse

CVE-2026-19884

What is CVE-2026-19884?

In Eclipse Theia versions up to and including 1.69.0, users experience a security flaw when opening a folder; it starts source control integration without prompting for trust. This occurs in applications utilizing the Theia platform, specifically those with git integration, allowing execution of git commands like 'git status' upon repository detection. An attacker could exploit this by placing a malicious '.git/config' in a folder, gaining the ability to execute arbitrary commands with user privileges. To mitigate this risk, starting from version 1.70.0, Theia has implemented measures to prevent the activation of plugins that declare unsupported capabilities in untrusted workspaces.

References