PT-2026-72042 · Eclipse Foundation+1 · Eclipse Theia+1
CVSS v4.0
8.4
High
| Vector | AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Eclipse Theia versions prior to 1.70.0
Description
Opening a folder in applications built on Theia that include git integration, such as the Theia IDE, triggers source control integration without requiring the user to trust the folder first. The
@theia/git extension and the builtin VS Code git extension execute commands like git status upon repository detection. Because git respects repository-local configurations, an attacker can provide a .git/config file containing a malicious core.fsmonitor setting or similar hook-like configuration. This allows for the execution of arbitrary commands with the privileges of the user without a confirmation prompt, which can be achieved by cloning and opening an attacker-supplied repository.Recommendations
Update Eclipse Theia to version 1.70.0 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Eclipse Theia
Vscode