CVE-2026-14574

Eclipse Theia (versions 0.7.0 through 1.73.1) contains a prototype pollution flaw (CWE-1321) in the PreferenceUtils.merge function of @theia/core, which recursively merges preference values without rejecting the __proto__, constructor, and prototype keys. Because PreferenceServiceImpl.doResolve invokes this function for every preference resolution across the default, user, workspace, and folder scopes, a crafted preference value in a workspace settings file (.theia/settings.json or .vscode/settings.json) pollutes Object.prototype when the user opens the workspace. An attacker who tricks a user into opening a malicious workspace can alter application logic within the Theia process (high integrity impact per CVSS 4.0, with low confidentiality and availability impact). Anyone running an affected Theia version is technically exposed, but the attack is local (AV:L), requires active user interaction (opening the workspace), and demands precise conditions, so the practical risk falls mainly on developers and users of Theia-based IDEs who open untrusted repositories. No in-the-wild exploitation is currently known: EPSS puts 30-day exploitation probability at 0.3%, the issue is not in CISA KEV, and two public PoC references exist in the Eclipse vulnerability tracker.

What to do: Update Eclipse Theia to a release newer than 1.73.1 (see the Eclipse advisory at gitlab.eclipse.org/security/vulnerability-reports/-/issues/567 for the fixed version); organizations using IDEs built on Theia should obtain patched builds from their downstream vendor. As an interim mitigation, avoid opening untrusted repositories/workspaces in Theia-based IDEs, or pre-screen .theia/settings.json and .vscode/settings.json for keys named __proto__, constructor, or prototype before opening them.