CVE-2026-82217

Eclipse Theia versions 1.73.0 through 1.74.x contain a path traversal flaw (CWE-22) in the AI Agent Mode file-change tools (writeFileContent, suggestFileContent, and the replacement and state helpers), which resolved model-supplied file paths without a workspace-containment check. An attacker who can steer the model's output, for example via indirect prompt injection in content the agent processes, can supply a relative path such as ../.bashrc, an absolute path, or a ~-expanded path; because Agent Mode applies writes without a confirmation dialog, files outside the workspace are written or deleted with the privileges of the Theia backend OS user. By writing to a host-executed file such as a shell startup file or ~/.ssh/authorized_keys, the attacker can escalate to arbitrary code execution on the backend host. Anyone running an affected Theia version with AI Agent Mode enabled is exposed, and the 8.8 CVSS score reflects network reachability with user interaction required. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known; EPSS estimates only about a 0.4% probability of exploitation in the next 30 days.

What to do: Upgrade Eclipse Theia to 1.75.0 or later, which adds the missing workspace-containment check. Until upgraded, disable AI Agent Mode or restrict the Theia backend OS user so it cannot modify host-executed files such as shell startup files and ~/.ssh/authorized_keys, and audit affected hosts for unexpected writes to files like .bashrc or authorized_keys. Treat content the agent reads as untrusted, since indirect prompt injection can steer the path argument.