CVE-2026-19884

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions prior to 1.70.0

Description Opening a folder in applications built on Theia that include git integration, such as the Theia IDE, triggers source control integration without requiring the user to trust the folder first. The @theia/git extension and the builtin VS Code git extension execute commands like git status upon repository detection. Because git respects repository-local configurations, an attacker can provide a .git/config file containing a malicious core.fsmonitor setting or similar hook-like configuration. This allows for the execution of arbitrary commands with the privileges of the user without a confirmation prompt, which can be achieved by cloning and opening an attacker-supplied repository.

Recommendations Update Eclipse Theia to version 1.70.0 or later.