Critical Vulnerability in Eclipse Theia: Path Traversal and Code Execution Risk
A critical vulnerability, CVE-2026-82217, with a CVSS score of 8.8, was discovered in Eclipse Theia versions 1.73.0 to 1.74.99. This vulnerability allows attackers to write or delete files outside the workspace with the privileges of the Theia backend OS user, potentially leading to code execution. The vulnerability is caused by a lack of workspace-containment checks in the AI 'Agent Mode' file-change tools. Immediate patching is recommended to prevent potential exploitation.