CVE-2026-82217: Eclipse Theia Path Traversal Vulnerability

CVE-2026-82217 Overview

CVE-2026-82217 is a path traversal vulnerability [CWE-22] in Eclipse Theia versions 1.73.0 up to but not including 1.75.0. The flaw exists in the AI Agent Mode file-change tools, including writeFileContent, suggestFileContent, and the associated replacement and state helpers. These tools resolve model-supplied file paths without enforcing a workspace-containment check. An attacker can supply crafted relative paths such as ../.bashrc, absolute paths, or tilde-expanded paths to write or delete files outside the workspace. Because the path is influenced by model output, the vulnerability can be triggered through indirect prompt injection.

Critical Impact
Writing to a host-executed file such as a shell startup file or ~/.ssh/authorized_keys can escalate to remote code execution on the Theia backend under the OS user running the process.

Affected Products

Eclipse Theia 1.73.0
Eclipse Theia 1.74.x
Eclipse Theia versions prior to 1.75.0 with AI Agent Mode enabled

Discovery Timeline

2026-08-31 - CVE-2026-82217 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82217

Vulnerability Analysis

Eclipse Theia's AI Agent Mode exposes file-manipulation tools that accept a path argument from the language model. The backend implementations of writeFileContent, suggestFileContent, and related helpers pass this string directly to filesystem operations. No containment check verifies that the resolved path stays within the workspace root. Agent Mode also bypasses the standard confirmation dialog, so writes execute silently. Combined, these behaviors allow arbitrary file writes and deletes at the privileges of the Theia backend OS user.

Root Cause

The root cause is missing workspace-boundary validation on model-controlled file paths [CWE-22]. Relative traversal sequences such as ../, absolute paths beginning with /, and shell-style ~ expansion all resolve to locations outside the intended project directory. Because the attacker-controlled string flows through the AI tool interface, standard user-consent gating is skipped in Agent Mode.

Attack Vector

Exploitation requires the victim to run Theia in Agent Mode and process attacker-influenced content, for example a repository README, issue text, or a fetched web page. Indirect prompt injection steers the model into calling writeFileContent with a path such as ~/.ssh/authorized_keys or ~/.bashrc. Once the malicious content is written, the next SSH login or shell session executes attacker-supplied commands on the backend host.

typescript

// Security patch excerpt - packages/ai-ide/src/browser/workspace-search-provider.ts
// The fix updates tool descriptions to reflect that paths must be workspace-contained
// or explicitly listed in ai-features.workspaceFunctions.allowedExternalPaths

subDirectoryPath: {
    type: 'string',
    description: 'Optional directory to limit the search scope ' +
        '(e.g., "frontend/src", "backend/packages/core/src/browser"). ' +
        'May also be an absolute path or `file://` URI of a directory the AI tools may access, ' +
        'such as one listed in the `ai-features.workspaceFunctions.allowedExternalPaths` preference. ' +
        'If not specified, searches the entire workspace.'
}
// Source: https://github.com/eclipse-theia/theia/commit/28da106c254

Detection Methods for CVE-2026-82217

Indicators of Compromise

Unexpected modifications to shell startup files such as ~/.bashrc, ~/.zshrc, or ~/.profile on hosts running the Theia backend.
New or altered entries in ~/.ssh/authorized_keys associated with the Theia service account.
Theia log entries showing AI tool calls to writeFileContent or suggestFileContent with paths containing ../, leading /, or ~.
Files created outside the active workspace directory shortly after Agent Mode sessions.

Detection Strategies

Enable filesystem auditing (auditd, FIM) on user home directories and SSH configuration paths on Theia backend hosts.
Parse Theia AI tool invocation logs for path arguments that resolve outside the declared workspace root.
Correlate Agent Mode sessions with subsequent SSH authentication events from unfamiliar keys.

Monitoring Recommendations

Alert on any write to authorized_keys, sudoers, or shell rc files on developer workstations and Theia servers.
Track versions of Eclipse Theia deployed across the environment and flag installations below 1.75.0.
Monitor outbound network activity from Theia backend hosts for signs of post-exploitation callbacks.

How to Mitigate CVE-2026-82217

Immediate Actions Required

Upgrade Eclipse Theia to version 1.75.0 or later where the workspace-containment check is enforced.
Disable AI Agent Mode until the upgrade is complete if patching cannot be scheduled immediately.
Audit ~/.ssh/authorized_keys and shell startup files on all Theia backend hosts for unauthorized changes.
Rotate SSH keys and credentials accessible to the Theia backend OS user if compromise is suspected.

Patch Information

The fix is included in Eclipse Theia 1.75.0. The corrective commit is available on GitHub at Eclipse Theia commit 28da106c254. Full advisory details are published in the GitLab Vulnerability Report #624.

Workarounds

Run the Theia backend as a low-privilege OS user with no write access to sensitive home directory files.
Restrict Agent Mode to trusted, offline content sources to reduce indirect prompt injection exposure.
Configure the ai-features.workspaceFunctions.allowedExternalPaths preference restrictively and review it regularly.
Require manual confirmation for all file-write tool calls where the deployment supports it.

bash

# Verify installed Theia version and enforce upgrade
npm ls @theia/core
# Upgrade to patched release
npm install @theia/core@^1.75.0

# Reduce blast radius by running the backend as an unprivileged user
useradd -r -s /usr/sbin/nologin theia-svc
chown -R theia-svc:theia-svc /opt/theia