[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions - @theia/task

Description

In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user’s privileges.

Recommendation

Update the @theia/task package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.69.0
• Patched version(s): 1.69.0

References

• GHSA-g9jw-92q7-g7fj
• gitlab.eclipse.org
• CVE-2026-44691
• CWE-829
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8