Sudhanshu

**Name of the Vulnerable Software and Affected Versions** Eclipse Theia versions prior to 1.70.0 **Description** Opening a folder in applications built on Theia that include git integration, such as the Theia IDE, triggers source control integration without requiring the user to trust the folder first. The `@theia/git` extension and the builtin VS Code `git` extension execute commands like `git status` upon repository detection. Because git respects repository-local configurations, an attacker can provide a `.git/config` file containing a malicious `core.fsmonitor` setting or similar hook-like configuration. This allows for the execution of arbitrary commands with the privileges of the user without a confirmation prompt, which can be achieved by cloning and opening an attacker-supplied repository. **Recommendations** Update Eclipse Theia to version 1.70.0 or later.