In Eclipse Theia up to version 1.73.1, the PreferenceUtils.merge function merges preference values recursively but does not filter out prototype‑related keys such as __proto__, constructor, or prototype. When PreferenceServiceImpl.doResolve processes preferences from default, user, workspace, or folder scopes, a maliciously crafted value in the workspace settings file (.theia/settings.json or .vscode/settings.json) can inject these keys into Object.prototype, potentially altering the behavior of objects across the entire Theia process. This flaw, identified as CWE‑1321, can compromise application integrity and lead to unintended application logic changes.

Affected users run Eclipse Theia versions 0.7.0 through 1.73.1; the vulnerability resides in the core module @theia/core and is triggered whenever workspace settings are loaded. All preference scopes—default, user, workspace, or folder—are affected, and a workspace containing prototype keys will exercise the flaw.

The CVSS score is 5.7, indicating medium severity, and the EPSS score is not available; the CVE is not listed in the CISA KEV catalog. Exploitation is most likely when an attacker can control the workspace settings file, such as by committing malicious settings to a shared repository or by compromising file access to a client’s workspace. Normal Theia users who open the affected workspace would trigger the prototype pollution, potentially enabling manipulation of preference processing or other application logic.