In Eclipse Theia versions up to 1.69.0, opening a folder automatically initiates source control integration and runs git commands such as "git status" without requiring the user to trust the folder first. An attacker can supply a repository containing a crafted ".git/config" file that uses a hook‑like setting such as "core.fsmonitor" to execute arbitrary commands when the repository is detected. Because git honors local configuration, the configured command runs with the privileges of the user and no confirmation prompt appears, giving the attacker full code execution capability within the Theia application. This flaw is a remote code execution vulnerability that stems from CWE‑15 (Improper Control of Generation of Code or Effects from External Input) and CWE‑829 (Harmless Duplicated Functionality).

The affected systems are all distributions of Eclipse Theia 1.69.0 or earlier, including applications built on Theia that include git integration such as the Theia IDE. The defect was addressed in 1.70.0 by disabling loading of untrusted workspaces for plugins that declare "capabilities.untrustedWorkspaces.supported: false", removing the deprecated @theia/git extension, and preventing git commands from being executed against untrusted folders.

The risk is high, with a CVSS score of 8.4. The EPSS score is not available, but the vulnerability does not require network exploitation; an attacker must supply a repository and persuade or trick a user into opening it in Theia. No exploitation is listed in CISA's KEV catalog, but the potential for arbitrary command execution makes this flaw critical for any environment that accepts untrusted code repositories.