The Eclipse Theia browser backend exposed privileged terminal RPC endpoints over WebSocket without authentication, and the origin check is fail-open. Socket.IO replaces the real Origin header with a client-supplied fix-origin header that an attacker can control or omit. As a result, a foreign-origin web page visited by a user with a running Theia instance can open the /services WebSocket namespace, invoke terminal creation, attach to the resulting terminal channel, execute arbitrary OS commands, and read their output, effectively giving remote code execution on the host.

Eclipse Foundation Eclipse Theia version 1.8.1 and later. The issue exists when the default configuration does not define a THEIA_HOSTS allowlist or lacks strong external authentication, including local developer setups and hosted or tunneled deployments that rely on default settings.

The CVSS score of 8.8 indicates a serious risk. The EPSS score of < 1% suggests a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by opening a WebSocket connection from an untrusted origin, bypassing the missing authentication and command-execution controls, and executing arbitrary OS commands. Organizations that expose Theia to untrusted networks or use default configurations remain at significant risk until patched or mitigated.