In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, whe…

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-44691 · Microsoft / collected KEV context

EUVD-2026-37901

GHSA-g9jw-92q7-g7fj

cve-program · CVE-2026-44691

• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/116

euvd · EUVD-2026-37901

• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/116

nvd · CVE-2026-44691

• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/116

osv · GHSA-g9jw-92q7-g7fj

• https://nvd.nist.gov/vuln/detail/CVE-2026-44691
• https://github.com/eclipse-theia/theia/issues/16889
• https://github.com/eclipse-theia/theia/pull/16917
• https://github.com/eclipse-theia/theia
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/116
• https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/331

No related operational record is retained in the current change model.