The flaw lies in Eclipse Theia’s AI "Agent Mode" file‑change tools, which incorrectly resolve a path supplied by the model without ensuring that it stays within the workspace. By providing a crafted relative path such as ../.bashrc, an absolute path, or a tilde‑expanded location, an attacker can cause the backend to write or delete files outside the intended area. The affected file‑change operations are executed with the Theia backend OS user’s privileges and are applied without a confirmation step, so an attacker who can influence the model’s output—via indirect prompt injection—can overwrite critical host files such as shell startup scripts or ~/.ssh/authorized_keys, enabling code execution on the backend.

Eclipse Foundation Eclipse Theia versions 1.73.0 through 1.74.x (up to, but not including, 1.75.0) are vulnerable. Any deployment running one of these releases is at risk.

The CVSS score of 8.8 indicates a high severity tier, and while EPSS data is not available, the capability to write or delete privileged files strongly suggests a high likelihood of exploitation. The lack of a workspace containment check permits directory traversal (CWE‑22). The primary attack vector is likely remote interaction with the Theia backend via the chatbot or other AI interfaces, with indirect prompt injection steering the model to produce the malicious path. Because the vulnerability is not listed in CISA’s KEV catalog, it may already be in active development or at risk of emerging exploitation once the feature is broadly used.