Indirect Prompt Injection in Eclipse Theia

Executive Summary

Eclipse Theia versions prior to 1.71.0 have a vulnerability where files matching the pattern `.prompts/*.prompttemplate` in a workspace are automatically loaded and can override or extend the AI agent's system prompts.

An attacker can create a malicious repository containing such prompt template files. When this repository is opened in Theia, the AI's system instructions are replaced with attacker-controlled content, which is an indirect prompt injection.

This vulnerability enables attack chains that can lead to data exfiltration through Markdown image rendering or arbitrary command execution via task definitions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary commands or exfiltrate data from your environment by injecting malicious prompts into the AI agent used within Eclipse Theia.

Specifically, attackers can exploit this by crafting malicious repositories that, when opened, replace system instructions of the AI, potentially leading to unauthorized data access or execution of harmful tasks.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves files matching the pattern `.prompts/*.prompttemplate` being automatically loaded in Eclipse Theia workspaces prior to version 1.71.0. To detect if your system is vulnerable, you can check for the presence of such files in your workspace directories.

You can use commands to search for these files in your workspace folders. For example, on a Unix-like system, you might run:

• find /path/to/workspace -type f -path '*.prompts/*.prompttemplate'

Additionally, verify the version of Eclipse Theia you are running to confirm if it is prior to 1.71.0:

• theia --version

If you find `.prompttemplate` files in your workspace or are running a vulnerable version, your system may be exposed to this vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Eclipse Theia to version 1.71.0 or later, where this vulnerability has been fixed.

Until you can upgrade, avoid opening untrusted or malicious workspaces that may contain `.prompts/*.prompttemplate` files, as these can override AI system prompts and enable attack chains.

You may also consider auditing and removing any `.prompttemplate` files from your workspace directories to prevent automatic loading of potentially malicious prompt templates.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0