The Eclipse Theia Website repository contains a GitHub Actions workflow that triggers on pull_request_target, allowing GitHub users to run untrusted pull‑request code during the workflow. This gives the code a GitHub token that has extensive write permissions, giving the attacker the ability to read and exfiltrate any secrets stored on the repository and to modify website content or publish malicious packages for the eclipse‑theia organization. The vulnerability is an example of Access Control: Improper Authorization of a Privileged Token (CWE‑829).

All instances of the Eclipse Theia Website that use the reported .github/workflows/preview.yml workflow are affected; no specific version of the website is listed, so all current deployments that include this workflow are considered vulnerable.

This flaw carries a CVSS base score of 10, indicating critical severity. The EPSS score is less than 1 %, suggesting very low exploitation probability, and it is not currently catalogued as a known exploited vulnerability. The likely attack vector is any GitHub user who can submit a pull request to the repository, causing the workflow to execute with a high‑privilege GITHUB_TOKEN. If exploited, the attacker could obtain secrets, alter the website, or inject malicious code into the repository.