The vulnerability allows an attacker to place malicious .prompttemplate files into a workspace, which Eclipse Theia automatically loads when the workspace is opened, effectively injecting or overriding the AI agent’s system prompts. This indirect prompt injection can be chained with other untrusted workspace features to either exfiltrate data through Markdown image rendering or trigger arbitrary command execution via task definitions. The weakness is a form of code injection (CWE-829) coupled with insecure handling of user‑supplied prompt files (CWE-1427).

Eclipse Theia versions before 1.71.0 are affected. The vulnerability impacts all installations that use the Theia IDE and host or open workspaces containing .prompts/*.prompttemplate files. This includes any user or team who accesses untrusted or third‑party repositories within Theia.

The CVSS score of 8.4 indicates a high severity risk. The EPSS score is not available, so the exploitation probability cannot be quantified, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers can exploit the issue by shipping a malicious repository that contains prompt template files; when a user opens the workspace, Theia loads the templates and the attacker can then manipulate system prompts or execute commands via task definitions. Consequently, data exfiltration or arbitrary code execution could occur on the users’ machines.