CVE-2026-82217 in Theia
Summary
by MITRE • 08/31/2026
In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replacement and state helpers) resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc, an absolute path, or a ~-expanded path could therefore write or delete files outside the workspace with the privileges of the Theia backend OS user. Because the path argument is influenced by model output, it can be steered through indirect prompt injection, and in Agent Mode writes are applied without a confirmation dialog. Writing to a host-executed file such as a shell startup file or ~/.ssh/authorized_keys can escalate to code execution on the backend.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified in Eclipse Theia versions 1.73.0 through 1.74.x represents a critical path traversal and unauthorized file access flaw within the AI Agent Mode functionality. This security issue stems from an insufficient validation of user-supplied input, specifically regarding how file paths are resolved by the backend services responsible for handling artificial intelligence-driven code assistance features. The affected tools include writeFileContent, suggestFileContent, and associated state helpers designed to manage file modifications during automated coding sessions. Under normal operational parameters, these tools should restrict their operations strictly within the boundaries of the designated workspace directory to prevent interference with system files or other user data. However, due to a missing workspace-containment check, the application fails to verify whether the target path resides inside the allowed scope before executing write or delete operations.
The technical mechanism of this flaw involves the resolution of relative paths without proper sanitization or canonicalization checks that enforce directory boundaries. An attacker can exploit this by providing crafted inputs such as relative paths containing dot-dot sequences like ../.bashrc, absolute paths pointing to sensitive system locations, or home-directory expanded paths using tilde notation. Because these path arguments are influenced directly by the output of large language models operating in Agent Mode, they become susceptible to indirect prompt injection attacks. In this scenario, a malicious actor does not need direct access to the application interface but can instead manipulate the AI model's response through carefully constructed prompts or context within the code being analyzed. The model may then generate file paths that escape the workspace directory structure, effectively bypassing intended security controls without triggering any user confirmation dialogs, which are typically present for manual edits in standard modes.
The operational impact of this vulnerability is severe, as it allows an authenticated attacker with access to the AI Agent Mode feature to write or delete arbitrary files on the host system running the Eclipse Theia backend process. Since these operations execute with the privileges of the OS user under which the backend service runs, the potential for privilege escalation and remote code execution is significant. By targeting critical configuration files such as shell startup scripts like .bashrc or SSH authorized keys located in ~/.ssh/authorized_keys, an attacker can inject malicious commands that are executed upon subsequent logins or system interactions. This capability effectively grants the attacker persistent access to the underlying infrastructure, potentially leading to full compromise of the development environment and any connected systems if the backend user possesses elevated permissions.
This vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory, as it involves accessing files outside the restricted directory intended for safe operation. It also relates to CWE-94 Improper Control of Generation of Code (Code Injection) when considering the potential for injecting malicious code via modified configuration files. From an offensive security perspective, this behavior is consistent with ATT&CK technique T1059 Command and Scripting Interpreter, particularly through indirect prompt injection vectors that leverage AI model outputs to execute unintended commands. The lack of confirmation dialogs further exacerbates the risk by removing a critical human-in-the-loop safeguard that might otherwise detect anomalous file modification attempts.
Mitigation strategies must prioritize immediate patching to version 1.75.0 or later, where these path validation checks have been implemented. In environments where upgrading is not immediately feasible, administrators should restrict access to the AI Agent Mode feature only to trusted users and consider running the backend service with minimal privileges using principle of least privilege to limit the impact of potential file system modifications. Additionally, implementing strict input validation on all paths passed to file manipulation APIs, ensuring that resolved absolute paths are strictly contained within the workspace root directory, is essential for preventing exploitation. Security teams should also monitor logs for unusual patterns in AI-generated code suggestions or unexpected file changes outside standard project directories to detect ongoing attempts at indirect prompt injection and path traversal attacks.