Description

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replacement and state helpers) resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc, an absolute path, or a ~-expanded path could therefore write or delete files outside the workspace with the privileges of the Theia backend OS user. Because the path argument is influenced by model output, it can be steered through indirect prompt injection, and in Agent Mode writes are applied without a confirmation dialog. Writing to a host-executed file such as a shell startup file or ~/.ssh/authorized_keys can escalate to code execution on the backend.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-31T14:17:26.610Z",
  "pubdate": "2026-08-31T14:17:26.610Z",
  "executiveSummary": "Eclipse Theia versions 1.73.0 through 1.74.0 are vulnerable to an Arbitrary File Write vulnerability stemming from a lack of workspace-containment validation in its AI 'Agent Mode' file-manipulation tools.\nThis vulnerability allows an attacker to leverage malicious model outputs—potentially triggered via indirect prompt injection—to write to or delete arbitrary files on the host filesystem with the privileges of the Theia backend process.\nThe inability to restrict file operations to the designated workspace boundary introduces a critical risk of Remote Code Execution (RCE). By targeting sensitive host-configuration files, such as shell initialization scripts (~/.bashrc) or SSH authorized keys (~/.ssh/authorized_keys), an attacker can achieve persistent unauthorized access and full control over the backend environment.\nBecause the 'Agent Mode' executes file-write operations without requiring a user-confirmation dialog, the exploitation process is silent and can be automated via coerced model behavior. This vulnerability significantly compromises the security integrity of the developer environment, moving the threat boundary from the restricted workspace to the underlying operating system.",
  "technicalDetails": "The vulnerability resides within the Eclipse Theia AI 'Agent Mode' toolset, specifically affecting the implementation of file-manipulation functions including writeFileContent, suggestFileContent, and associated replacement and state-management helpers.\nThe root cause is a fundamental failure to perform Path Traversal sanitization or workspace-containment checks on file paths provided by the AI model. In these versions, the backend process accepts file system path arguments directly from the LLM without validating that the target destination resides within the authorized workspace directory.\nAn attacker can exploit this by crafting a payload that forces the model to emit path specifications containing directory traversal sequences (e.g., ../), absolute paths, or paths utilizing home-directory expansion (~). Because the system executes these file operations as the authenticated backend OS user, the model can be tricked into overwriting, corrupting, or deleting any file accessible to that user.\nThe attack flow typically begins with an indirect prompt injection, where an attacker introduces malicious instructions into a source repository or chat context. When the AI agent processes this content, it generates a response invoking the vulnerable tool functions with a manipulated path. Due to the lack of a mandatory confirmation dialog, the system immediately applies the requested file changes, bypassing security boundaries.\nThe post-exploitation impact is severe. By writing to shell configuration files (such as .bashrc, .zshrc, or .profile) or appending malicious keys to ~/.ssh/authorized_keys, an attacker can hijack the backend OS session. Subsequent execution of these files or automated login attempts results in arbitrary command execution on the host machine, effectively granting the attacker the same persistence and privilege level as the Theia backend service.\nThis issue affects all instances of Eclipse Theia from 1.73.0 up to, but not including, 1.75.0. Successful exploitation does not require pre-existing system-level authentication from the attacker, provided they have the capability to influence the AI's input stream, making this a high-risk vector for supply-chain or workspace-poisoning attacks."
}