CVE-2026-14574

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions 0.7.0 through 1.73.1

Description The PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys such as proto, constructor, and prototype. This function is called by PreferenceServiceImpl.doResolve during preference resolution across various scopes. A crafted preference value within a workspace settings file, specifically .theia/settings.json or .vscode/settings.json, can lead to prototype pollution of Object.prototype when a user opens the workspace, which may alter application logic throughout the process.

Recommendations Update Eclipse Theia to a version later than 1.73.1.