Wu Junming

**Name of the Vulnerable Software and Affected Versions** Eclipse Theia versions 0.7.0 through 1.73.1 **Description** The `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values without rejecting prototype-related keys such as ` proto `, `constructor`, and `prototype`. This function is called by `PreferenceServiceImpl.doResolve` during preference resolution across various scopes. A crafted preference value within a workspace settings file, specifically `.theia/settings.json` or `.vscode/settings.json`, can lead to prototype pollution of `Object.prototype` when a user opens the workspace, which may alter application logic throughout the process. **Recommendations** Update Eclipse Theia to a version later than 1.73.1.