CVE-2026-1699: Critical severity Eclipse theia vulnerability
In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pullrequesttarget trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to repository secrets and a GITHUBTOKEN with extensive write permissions (contents:write, packages:write, pages:write, actions:write). An attacker could exfiltrate secrets, publish malicious packages to the eclipse-theia organization, modify the official Theia website, and push malicious code to the repository.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1699?
CVE-2026-1699 is classified as a high severity vulnerability due to its potential for arbitrary code execution in the CI environment.
How do I fix CVE-2026-1699?
To mitigate CVE-2026-1699, update the GitHub Actions workflow to use the 'pull_request' trigger instead of 'pull_request_target'.
What impact does CVE-2026-1699 have on Eclipse Theia?
CVE-2026-1699 allows untrusted pull request code to be executed, posing significant risks of compromising the repository's CI environment.
Who is affected by CVE-2026-1699?
Any repository utilizing the affected GitHub Actions workflow in Eclipse Theia is vulnerable to CVE-2026-1699.
When was CVE-2026-1699 disclosed?
CVE-2026-1699 was disclosed as part of security assessments for the Eclipse Theia project.