[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions - @theia/debug

Description

In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user’s privileges.

Recommendation

Update the @theia/debug package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.69.0
• Patched version(s): 1.69.0

References

• GHSA-g9jw-92q7-g7fj
• gitlab.eclipse.org
• CVE-2026-44691
• CWE-829
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• [Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions - @theia/task - CVE-2026-44691
• [Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions - CVE-2026-44691
• [Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat - @theia/ai-chat-ui - CVE-2026-44688
• [Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat - @theia/ai-chat - CVE-2026-44688

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@theia/debug