CVE-2026-14574: Medium severity Eclipse theia vulnerability
In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys (proto, constructor, prototype). Because this function is invoked by PreferenceServiceImpl.doResolve for every preference resolution across scopes (default, user, workspace, folder), a crafted preference value in a workspace settings file (.theia/settings.json or .vscode/settings.json) can pollute Object.prototype when the user opens the workspace, potentially altering application logic across the Theia process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14574?
CVE-2026-14574 has a risk score of 65, indicating a medium severity level.
How do I fix CVE-2026-14574?
To fix CVE-2026-14574, update Eclipse Theia to the latest version that addresses the vulnerability.
Which versions of Eclipse Theia are affected by CVE-2026-14574?
CVE-2026-14574 affects Eclipse Theia versions from 0.7.0 up to and including 1.73.1.
What is the impact of CVE-2026-14574?
CVE-2026-14574 allows for potential prototype pollution due to the improper handling of specific keys in preference merging.
Is there a workaround for CVE-2026-14574?
There is no specified workaround for CVE-2026-14574; the best course of action is to update to a secure version.