Piotr Ryciak

The AI chat renders Markdown image tags from AI responses, which triggers unrestricted HTTP requests to arbitrary external URLs. When combined with prompt injection in a malicious workspace, an attacker can force the AI agent to create image URLs that encode sensitive information from the conversation context or workspace, allowing the data to be exfiltrated to servers controlled by the attacker.

The AI chat agent processes workspace file and directory names as part of its prompt context without distinguishing them from system instructions. This allows for indirect prompt injection, where an attacker crafts a malicious repository with adversarial names that force the AI agent to follow attacker-controlled instructions. When used in untrusted workspaces, this can lead to attack chains resulting in arbitrary command execution via task definitions or data exfiltration through Markdown image rendering.

Custom task definitions in workspace files, such as `.theia/tasks.json` and `.vscode/tasks.json`, can be executed without requiring workspace trust. This allows an attacker to create a malicious repository that executes arbitrary commands with the user's privileges when cloned and opened. If AI chat features are used and the `.theia/settings.json` file is configured to disable tool confirmation, the execution can be triggered automatically via a message in the AI chat.

Files matching the pattern `.prompts/*.prompttemplate` in a workspace are automatically loaded, allowing them to override or extend the AI agent's system prompts. This enables indirect prompt injection, where an attacker crafts a malicious repository with prompt template files that replace the AI's system instructions with attacker-controlled content when the workspace is opened. When combined with other AI chat features in untrusted workspaces, this can lead to attack chains resulting in arbitrary command execution via task definitions or data exfiltration through Markdown image rendering.

A stored cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `VLAN View Name` field. This enables attackers to potentially manipulate the web application's behavior.