CVE-2026-82217: Path Traversal
In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replacement and state helpers) resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc, an absolute path, or a ~-expanded path could therefore write or delete files outside the workspace with the privileges of the Theia backend OS user. Because the path argument is influenced by model output, it can be steered through indirect prompt injection, and in Agent Mode writes are applied without a confirmation dialog. Writing to a host-executed file such as a shell startup file or ~/.ssh/authorizedkeys can escalate to code execution on the backend.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eclipse Theiato a version that resolves this vulnerability.Fixed in 1.75.0 - Compensating control
In Eclipse Theia AI Agent Mode, restrict/disable use of the file-change tools (writeFileContent, suggestFileContent, and the replacement/state helpers) for model-influenced paths to prevent writes outside the workspace when a workspace-containment check is missing.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Eclipse Theia versions 1.73.0 through 1.74.x are affected when AI Agent Mode file-change tools are used. The impact is limited by the permissions of the Theia backend OS user, but files outside the workspace may be modified or deleted with those permissions.
What does an attacker need to exploit it?
An attacker needs to influence model output, such as through indirect prompt injection, so that the model supplies a path outside the workspace. Exploitation requires user interaction because the issue has a UI:R vector, but Agent Mode applies writes without a confirmation dialog.
Can this lead to code execution?
Yes. If the backend user can write host-executed files such as shell startup files or ~/.ssh/authorized_keys, modifying those files can lead to code execution on the backend.
How can exposure be reduced before updating?
Avoid using Agent Mode file-change tools where untrusted content could influence model output. Run the Theia backend with a minimally privileged OS account so that writes outside the workspace cannot affect sensitive user or system files.