In versions of Eclipse Theia older than 1.71.0, the AI chat agent treats workspace file and directory names as part of its prompt context without distinguishing them from system instructions. This flaw allows an attacker to create a repository with maliciously named files or directories that, when processed by the agent, can embed attacker-controlled commands or instructions. The result is an indirect prompt injection that could result in data exfiltration via Markdown image rendering or arbitrary command execution through task definitions. The weakness aligns with CWE-1427 and CWE-829.

These issues affect Eclipse Theia supplied by Eclipse Foundation. All releases before version 1.71.0 are impacted, meaning users running 1.70.x and earlier are vulnerable.

The CVSS score of 8.4 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of mitigation probably means attackers can still use the flaw. The likely attack vector involves an attacker providing a malicious repository to a user or system that has untrusted workspace AI chat enabled. The attack chain may utilize Markdown image rendering to exfiltrate data or activate pre-defined tasks that execute arbitrary commands, fulfilling the attacker’s objectives.