Khoa Bui

**Name of the Vulnerable Software and Affected Versions** Eclipse Theia versions 1.73.0 through 1.74.x **Description** In AI Agent Mode, file-change tools resolve model-supplied file paths without verifying if they are contained within the workspace. This allows a crafted relative path, an absolute path, or a ~-expanded path to write or delete files outside the workspace using the privileges of the backend OS user. Since the path argument is influenced by model output, it can be manipulated via indirect prompt injection. In Agent Mode, these writes occur without a confirmation dialog. Writing to host-executed files, such as shell startup files or `~/.ssh/authorized keys`, can lead to code execution on the backend. The affected tools include `writeFileContent()`, `suggestFileContent()`, and the replacement and state helpers. **Recommendations** Update Eclipse Theia to version 1.75.0 or later. As a temporary mitigation, restrict the use of the `writeFileContent()` and `suggestFileContent()` functions in Agent Mode.