{"id":"EUVD-2026-37900","enisaUuid":"ddb5c5bf-ce7b-3971-b7d2-0eee32506fd1","description":"In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an attacker could induce the AI agent to construct image URLs encoding sensitive information from the workspace or conversation context, exfiltrating it to attacker-controlled servers. The workspace trust enforcement introduced in v1.71.0 mitigates the documented attack chain by disabling AI features in untrusted workspaces.","datePublished":"Jun 18, 2026, 2:32:01 PM","dateUpdated":"Jun 18, 2026, 3:25:13 PM","baseScore":6.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/115\n","aliases":"CVE-2026-22551\nGHSA-qwjm-9c66-w4q4\n","assigner":"eclipse","epss":0.31,"enisaIdProduct":[{"id":"e0ff5e90-c73b-37e5-94fa-c623ea69a3d1","product":{"name":"Eclipse Theia","vendor":{"name":"The Eclipse Foundation"}},"product_version":"0 \u003c1.71.0"}],"enisaIdVendor":[{"id":"e690ffcf-31da-3435-bdf2-8dfcdc06a53c","vendor":{"name":"Eclipse Foundation"}}],"enisaIdVulnerability":[{"id":"977daf79-3851-3e7f-85f7-5390aa8e8ef2","vulnerability":{"id":"GHSA-qwjm-9c66-w4q4","description":"[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat","datePublished":"Jun 18, 2026, 6:35:22 PM","dateUpdated":"Jun 19, 2026, 7:19:23 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-22551\nhttps://github.com/eclipse-theia/theia/issues/16892\nhttps://github.com/eclipse-theia/theia/pull/17364\nhttps://github.com/eclipse-theia/theia/commit/e3fdfe6992389bc5fa611058d00c39d7408508ed\nhttps://github.com/eclipse-theia/theia\nhttps://gitlab.eclipse.org/security/cve-assignment/-/work_items/115\n","enisa_id":"EUVD-2026-37900\n","aliases":"GHSA-qwjm-9c66-w4q4\nCVE-2026-22551\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e71c9ec4-cced-32b1-ab30-f18e52ca8872","vulnerability":{"id":"CVE-2026-22551","description":"In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an attacker could induce the AI agent to construct image URLs encoding sensitive information from the workspace or conversation context, exfiltrating it to attacker-controlled servers. The workspace trust enforcement introduced in v1.71.0 mitigates the documented attack chain by disabling AI features in untrusted workspaces.","datePublished":"Jun 18, 2026, 2:32:01 PM","dateUpdated":"Jun 18, 2026, 3:25:13 PM","status":"PUBLISHED","baseScore":6.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/115\n","enisa_id":"EUVD-2026-37900\n","assigner":"eclipse","epss":0.31,"dataProcessed":"Oct 29, 2026, 7:19:05 AM","vulnerabilityProduct":[{"id":"794474d6-840e-3dd9-bd0a-5a5c4aba72e7","product":{"name":"Eclipse Theia","vendor":{"name":"The Eclipse Foundation"}},"product_version":"0 \u003c1.71.0"}],"vulnerabilityVendor":[{"id":"32ea9a46-ce8c-3eba-8c8d-9b55ec6acaff","vendor":{"name":"Eclipse Foundation"}}]}}],"enisaIdAdvisory":[]}