CVE-2026-14574 In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges pref
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-14574?
CVE-2026-14574 is a medium-severity vulnerability in Eclipse Theia, published on 5 Aug 2026.
Official description
In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values without rejecting prototype-related keys (`__proto__`, `constructor`, `prototype`). Because this function is invoked by `PreferenceServiceImpl.doResolve` for every preference resolution across scopes (default, user, workspace, folder), a crafted preference value in a workspace settings file (`.theia/settings.json` or `.vscode/settings.json`) can pollute `Object.prototype` when the user opens the workspace, potentially altering application logic across the Theia process.
Weakness: CWE-1321
Which versions are affected by CVE-2026-14574?
It affects 1 product.
Products include Eclipse Theia.
How do I fix CVE-2026-14574?
No fix has been published for CVE-2026-14574 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-14574 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-14574 exists.
Other vulnerabilities in Eclipse Theia
- CVE-2021-34436 XML external entity in Eclipse Theia
- CVE-2020-27224 Cross-site Scripting (XSS) in Eclipse Theia
- CVE-2026-60009 File upload in Eclipse Theia
- CVE-2021-34435 Remote code execution in Eclipse Theia
- CVE-2026-44688 [Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat
Sources
Also known as GHSA-5f8h-2xph-wwxv, GHSA-f3w9-qfw3-xr32.