CVE-2026-19884
Received Received - Intake

Untrusted Workspace Command Execution in Eclipse Theia

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: Eclipse Foundation

Description
In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia that include the git integration, such as the Theia IDE. Both Theia's own `@theia/git` extension and the builtin VS Code `git` extension run git commands such as `git status` as soon as a repository is detected. Since git honors repository-local configuration, a folder containing an attacker-controlled `.git/config` with `core.fsmonitor` (or a comparable hook-like setting) causes the configured command to be executed. The configuration can be delivered by burying a bare repository inside a regular repository (OVE-20210718-0001), so cloning an attacker-supplied repository and opening it in a Theia-based application is sufficient to execute arbitrary commands with the privileges of the user, without any confirmation prompt. As of 1.70.0, plugins that declare `capabilities.untrustedWorkspaces.supported: false`, which includes the builtin git extension, are no longer loaded or activated in an untrusted workspace, and the deprecated `@theia/git` extension has been removed, so no git command is executed against an untrusted folder.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-19884
EUVD
EUVD-2026-58685

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
eclipse theia to 1.45.0 (inc)
eclipse theia to 1.70.0 (inc)
eclipse theia to 1.69.0 (inc)
eclipse theia From 1.70.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
CWE-15 One or more system settings or configuration elements can be externally controlled by a user.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Eclipse Theia versions up to 1.69.0. When a user opens a folder, Theia automatically starts Git integration and runs commands like git status without requiring user trust. Attackers can embed a malicious .git/config file with settings like core.fsmonitor in a repository. Opening such a folder triggers arbitrary command execution with the user's privileges, without any confirmation prompt.

Detection Guidance

Check Eclipse Theia version with 'theia --version' or inspect package.json for versions up to 1.69.0. Look for unexpected git commands running in logs like 'git status' or 'git fsmonitor--daemon'. Search for suspicious .git/config files with hooks or fsmonitor settings.

Impact Analysis

An attacker could trick you into executing malicious commands by simply having you open a folder containing a specially crafted Git repository. This could allow the attacker to run programs like calc.exe on Windows or write files to sensitive locations like /tmp on Linux, all with your user privileges.

Compliance Impact

This vulnerability could lead to arbitrary code execution when a user opens a malicious repository in Eclipse Theia. For GDPR, this may result in unauthorized data access or processing if attacker-controlled commands exfiltrate personal data. For HIPAA, it risks exposing protected health information if commands access or modify sensitive files. Compliance violations may occur due to lack of user consent for command execution and insufficient controls over data processing activities.

Mitigation Strategies

Upgrade to Eclipse Theia 1.70.0 or later. Disable automatic git integration in untrusted workspaces. Avoid opening untrusted repositories. Enable workspace trust prompts if using older versions. Remove deprecated @theia/git extension if present.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19884. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart