CVE-2026-14574 Overview
CVE-2026-14574 is a prototype pollution vulnerability [CWE-1321] in Eclipse Theia, an open-source cloud and desktop IDE framework. The flaw resides in the PreferenceUtils.merge function within @theia/core, which recursively merges preference values without filtering dangerous keys such as __proto__, constructor, and prototype. Because PreferenceServiceImpl.doResolve invokes this merge for every preference resolution across default, user, workspace, and folder scopes, a crafted .theia/settings.json or .vscode/settings.json file can pollute Object.prototype when a user opens the workspace. The vulnerability affects Eclipse Theia versions 0.7.0 through 1.73.1.
Critical Impact
Opening an attacker-supplied workspace triggers prototype pollution across the entire Theia process, altering application logic and integrity.
Affected Products
- Eclipse Theia @theia/core versions 0.7.0 through 1.73.1
- Applications built on the Eclipse Theia framework
- Downstream IDE distributions embedding vulnerable Theia versions
Discovery Timeline
- 2026-08-05 - CVE-2026-14574 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-14574
Vulnerability Analysis
Eclipse Theia manages user configuration through layered preference scopes: default, user, workspace, and folder. The PreferenceServiceImpl.doResolve method combines these scopes by delegating to PreferenceUtils.merge, which performs a recursive deep merge on preference objects. The merge routine copies properties from a source object into a target without validating property names against JavaScript's prototype chain identifiers.
When the parser encounters a key such as __proto__, the assignment writes onto Object.prototype rather than a local property. Any object created afterward inherits the polluted value. Because preferences are resolved throughout the Theia process lifetime, the pollution persists for the session and can cascade into security-sensitive code paths, including access control checks, plugin loading, and command dispatch logic.
Root Cause
The root cause is missing key validation during recursive object merging [CWE-1321]. The PreferenceUtils.merge implementation does not reject or sanitize properties named __proto__, constructor, or prototype before copying source values into the target object.
Attack Vector
Exploitation requires local access and user interaction. An attacker crafts a workspace containing a malicious .theia/settings.json or .vscode/settings.json file with a preference key that references __proto__. When a victim opens the workspace in a vulnerable Theia-based IDE, the preference service resolves the file and pollutes Object.prototype. The polluted properties then influence downstream logic that reads object attributes without hasOwnProperty checks. See the Eclipse Theia Security Advisory GHSA-f3w9-qfw3-xr32 for technical details.
Detection Methods for CVE-2026-14574
Indicators of Compromise
- Workspace files at .theia/settings.json or .vscode/settings.json containing JSON keys named __proto__, constructor, or prototype
- Unexpected properties appearing on JavaScript objects during Theia runtime that were not explicitly set
- Abnormal behavior in Theia extensions or commands immediately after opening a new workspace
Detection Strategies
- Scan repositories and shared workspaces for settings files containing prototype-related keys before opening them in Theia
- Enable Node.js runtime instrumentation to log writes to Object.prototype during IDE sessions
- Review Theia application logs for preference resolution errors or unexpected inherited property access
Monitoring Recommendations
- Monitor endpoint file activity for the creation of .theia/settings.json or .vscode/settings.json files from untrusted sources such as cloned repositories or shared drives
- Track child process creation and file writes originating from Theia-based IDE processes after workspace open events
- Correlate developer workstation telemetry with source control clone events to identify high-risk workspace openings
How to Mitigate CVE-2026-14574
Immediate Actions Required
- Upgrade @theia/core to a fixed version released after 1.73.1 as published in the Eclipse Theia Security Advisory
- Instruct developers to avoid opening untrusted workspaces or repositories in Theia-based IDEs until patched
- Audit existing workspace settings files across the organization for prototype-related keys
Patch Information
Eclipse Theia maintainers published a fix through the Eclipse Theia Security Advisory GHSA-f3w9-qfw3-xr32. The fix modifies PreferenceUtils.merge to reject prototype-related keys during recursive merging. Additional coordination details are available in the Eclipse GitLab CVE assignment and the vulnerability report issue.
Workarounds
- Before opening any repository, manually inspect .theia/settings.json and .vscode/settings.json for keys matching __proto__, constructor, or prototype
- Configure endpoint controls to block Theia from loading workspace-scoped settings files from untrusted directories
- Restrict developer accounts from opening workspaces cloned from external, unvetted sources until upgrades are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
