[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-chat-ui

Description

In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction.

Recommendation

Update the @theia/ai-chat-ui package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.71.0
• Patched version(s): 1.71.0

References

• GHSA-qwjm-9c66-w4q4
• gitlab.eclipse.org
• CVE-2026-22551
• CWE-201
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• [Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-chat - CVE-2026-22551
• [Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-claude-code - CVE-2026-22551
• [Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-code-completion - CVE-2026-22551
• [Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat - @theia/ai-core - CVE-2026-22551

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@theia/ai-chat-ui