Piotr Ryciak

**Name of the Vulnerable Software and Affected Versions** Eclipse Theia versions prior to 1.71.0 **Description** The AI chat renders Markdown image tags from AI responses, which triggers unrestricted HTTP requests to arbitrary external URLs. When combined with prompt injection in a malicious workspace, an attacker can force the AI agent to create image URLs that encode sensitive information from the conversation context or workspace, allowing the data to be exfiltrated to servers controlled by the attacker. **Recommendations** Update to version 1.71.0 or later to enable workspace trust enforcement, which disables AI features in untrusted workspaces.

**Name of the Vulnerable Software and Affected Versions** Eclipse Theia versions prior to 1.71.0 **Description** The AI chat agent processes workspace file and directory names as part of its prompt context without distinguishing them from system instructions. This allows for indirect prompt injection, where an attacker crafts a malicious repository with adversarial names that force the AI agent to follow attacker-controlled instructions. When used in untrusted workspaces, this can lead to attack chains resulting in arbitrary command execution via task definitions or data exfiltration through Markdown image rendering. **Recommendations** Update to version 1.71.0 or later.

**Name of the Vulnerable Software and Affected Versions** Eclipse Theia versions prior to 1.69.0 **Description** Custom task definitions in workspace files, such as `.theia/tasks.json` and `.vscode/tasks.json`, can be executed without requiring workspace trust. This allows an attacker to create a malicious repository that executes arbitrary commands with the user's privileges when cloned and opened. If AI chat features are used and the `.theia/settings.json` file is configured to disable tool confirmation, the execution can be triggered automatically via a message in the AI chat. **Recommendations** Update to version 1.69.0 or later.

**Name of the Vulnerable Software and Affected Versions** Eclipse Theia versions prior to 1.71.0 **Description** Files matching the pattern `.prompts/*.prompttemplate` in a workspace are automatically loaded, allowing them to override or extend the AI agent's system prompts. This enables indirect prompt injection, where an attacker crafts a malicious repository with prompt template files that replace the AI's system instructions with attacker-controlled content when the workspace is opened. When combined with other AI chat features in untrusted workspaces, this can lead to attack chains resulting in arbitrary command execution via task definitions or data exfiltration through Markdown image rendering. **Recommendations** Update to version 1.71.0 or later.

**Name of the Vulnerable Software and Affected Versions** Infoblox NIOS version 8.5.2-409296 **Description** A stored cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `VLAN View Name` field. This enables attackers to potentially manipulate the web application's behavior. **Recommendations** For Infoblox NIOS version 8.5.2-409296, consider restricting access to the VLAN View Name field until a patch is available. As a temporary workaround, avoid using the `VLAN View Name` field for any input that may contain malicious scripts. At the moment, there is no information about a newer version that contains a fix for this issue.