{"id":"EUVD-2026-37901","enisaUuid":"0b7b8224-2424-3f7f-a40e-2bced01e5814","description":"In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user\u0027s privileges. In combination with AI chat features and a workspace .theia/settings.json that disabled tool confirmation, this could be triggered automatically by sending a message in the AI chat.","datePublished":"Jun 18, 2026, 2:35:25 PM","dateUpdated":"Jun 19, 2026, 3:55:44 AM","baseScore":8.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/116\n","aliases":"CVE-2026-44691\nGHSA-g9jw-92q7-g7fj\n","assigner":"eclipse","epss":0.41,"enisaIdProduct":[{"id":"4c4da234-624d-3d9e-8a88-cf2808980e7d","product":{"name":"Eclipse Theia","vendor":{"name":"The Eclipse Foundation"}},"product_version":"0 \u003c1.69.0"}],"enisaIdVendor":[{"id":"560dcef1-f473-3614-b376-d5dc2ea2d27e","vendor":{"name":"Eclipse Foundation"}}],"enisaIdVulnerability":[{"id":"8d4bceff-2520-3d1d-85ae-c94bda788a1d","vulnerability":{"id":"CVE-2026-44691","description":"In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user\u0027s privileges. In combination with AI chat features and a workspace .theia/settings.json that disabled tool confirmation, this could be triggered automatically by sending a message in the AI chat.","datePublished":"Jun 18, 2026, 2:35:25 PM","dateUpdated":"Jun 19, 2026, 3:55:44 AM","status":"PUBLISHED","baseScore":8.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/116\n","enisa_id":"EUVD-2026-37901\n","assigner":"eclipse","epss":0.41,"dataProcessed":"Nov 1, 2026, 7:18:42 AM","vulnerabilityProduct":[{"id":"a30f6613-3020-383f-b0ec-85365db15718","product":{"name":"Eclipse Theia","vendor":{"name":"The Eclipse Foundation"}},"product_version":"0 \u003c1.69.0"}],"vulnerabilityVendor":[{"id":"b935f908-2be1-3c8b-b005-bb4c089cfeb8","vendor":{"name":"Eclipse Foundation"}}]}},{"id":"a5cfd06c-ab62-35ad-a68d-77b5978e3a68","vulnerability":{"id":"GHSA-g9jw-92q7-g7fj","description":"[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions","datePublished":"Jun 18, 2026, 6:35:23 PM","dateUpdated":"Jun 19, 2026, 7:20:20 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-44691\nhttps://github.com/eclipse-theia/theia/issues/16889\nhttps://github.com/eclipse-theia/theia/pull/16917\nhttps://github.com/eclipse-theia/theia\nhttps://gitlab.eclipse.org/security/cve-assignment/-/work_items/116\nhttps://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/331\n","enisa_id":"EUVD-2026-37901\n","aliases":"CVE-2026-44691\nGHSA-g9jw-92q7-g7fj\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}