Prototype Pollution in Eclipse Theia via PreferenceUtils.merge

Executive Summary

CVE-2026-14574 is a prototype pollution vulnerability in Eclipse Theia versions 0.7.0 to 1.73.1. The PreferenceUtils.merge function recursively merges preference values without rejecting prototype-related keys like __proto__, constructor, or prototype. When PreferenceServiceImpl.doResolve processes workspace settings, malicious preference values can pollute Object.prototype, altering application logic across the Theia process.

Useful 0 Not Useful 0

Detection Guidance

Check workspace settings files like .theia/settings.json or .vscode/settings.json for suspicious entries containing prototype pollution keys such as __proto__, constructor, or prototype. Inspect preference resolution logs for unexpected prototype modifications during application startup.

Useful 0 Not Useful 0

Impact Analysis

An attacker could manipulate inherited properties in the application by injecting prototype pollution via workspace settings files. This may lead to logic tampering, unauthorized configuration access, or denial of service, depending on how preferences are handled in the host application.

Useful 0 Not Useful 0

Mitigation Strategies

Update Eclipse Theia to a version beyond 1.73.1 where the fix is implemented. If updating is not possible, manually inspect and sanitize preference files, removing any prototype pollution keys. Implement input validation to reject __proto__, constructor, and prototype keys during preference processing.

Useful 0 Not Useful 0