{"id":"GHSA-g9jw-92q7-g7fj","revision":"26b6ba9205a84c77995291a8e674154c","records":[{"revision":"26b6ba9205a84c77995291a8e674154c","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-g9jw-92q7-g7fj","aliases":["CVE-2026-44691"],"title":"[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions","description":"In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user's privileges. In combination with AI chat features and a workspace .theia/settings.json that disabled tool confirmation, this could be triggered automatically by sending a message in the AI chat.","state":0,"publishedAt":"2026-06-18T18:35:23+00:00","modifiedAt":"2026-09-10T03:51:08.7925913+00:00","affected":[{"ecosystem":"npm","name":"@theia/debug","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.69.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@theia/task","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.69.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@theia/workspace","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.69.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-44691","https://github.com/eclipse-theia/theia/issues/16889","https://github.com/eclipse-theia/theia/pull/16917","https://github.com/eclipse-theia/theia","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/116","https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/331"],"sourceUrl":"https://github.com/advisories/GHSA-g9jw-92q7-g7fj","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-g9jw-92q7-g7fj","identifiers":["GHSA-g9jw-92q7-g7fj","CVE-2026-44691"]},"retained":false,"historicalAffected":[]}],"coverage":[]}