WebSocket Origin Validation Flaw in Eclipse Theia

Executive Summary

CVE-2026-10054 is a vulnerability in Eclipse Theia versions 1.8.1 and later, where the browser backend exposes privileged terminal RPC over WebSocket endpoints (/services/shell-terminal, /services/terminals/:id) without proper service-level authentication.

The WebSocket origin validation in the @theia/core package is fail-open, meaning connections are accepted even when the Origin header is missing or when no THEIA_HOSTS allowlist is configured. Additionally, the Socket.IO integration replaces the real Origin header with a client-controlled fix-origin header, which attackers can manipulate or omit.

As a result, a malicious webpage from a foreign origin can connect to the Theia backend's WebSocket namespace, create a terminal, execute arbitrary operating system commands, and read their output without authentication or authorization. This affects both local developer setups and hosted or tunneled deployments lacking strong external authentication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized remote code execution and data exfiltration. An attacker can execute arbitrary OS commands on the affected system by exploiting the exposed terminal RPC over WebSocket.

It affects confidentiality, integrity, and availability of the system by allowing attackers to run commands and read their output, potentially compromising sensitive data and system stability.

Both local developer environments (via drive-by attacks) and hosted or tunneled Theia deployments without strong authentication are at risk, which could lead to full system compromise.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to connect to the Eclipse Theia backend WebSocket endpoints related to terminal services, specifically /services/shell-terminal and /services/terminals/:id, from a foreign origin or unauthorized client.

One practical detection method is to try executing a command such as `id` through the WebSocket terminal interface to verify if arbitrary command execution is possible without authentication.

A known exploit involves using a script that starts Theia on one port and serves a malicious webpage on another, which connects to the WebSocket namespace and executes commands to confirm the vulnerability.

• Attempt to connect to ws://<theia-host>/services/shell-terminal or /services/terminals/:id using a WebSocket client from a different origin.
• Use a WebSocket client or script to send commands like `id` through the terminal channel and check if the output is returned.
• Monitor network traffic for unauthorized WebSocket connections to the /services namespace.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the Theia backend terminal services and enforcing authentication and authorization.

• Configure the THEIA_HOSTS environment variable to restrict allowed WebSocket origins.
• Isolate the Theia backend from untrusted networks to prevent unauthorized remote access.
• Use a reverse proxy in front of Theia that enforces strong authentication and authorization.
• Disable the terminal service entirely if it is not required.

A fix is in development that will enforce same-origin validation by default, remove trust in the fix-origin header, and gate access using secure cookies.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to execute arbitrary OS commands and read their output by exploiting missing authentication and origin validation in the Eclipse Theia terminal services. This leads to a high risk of unauthorized access to sensitive data and system control.

Such unauthorized access and potential data exfiltration can result in violations of common security requirements found in standards and regulations like GDPR and HIPAA, which mandate protection of sensitive data and strict access controls.

Therefore, if an organization uses affected versions of Eclipse Theia without proper mitigations, it may fail to comply with these regulations due to the risk of data breaches and unauthorized system access.

Useful 0 Not Useful 0