CVE-2026-44688 [Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat
Attackers can execute arbitrary code or exfiltrate data by crafting malicious file names that trigger indirect prompt injection in the AI chat agent.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-44688?
CVE-2026-44688 is a high-severity code injection vulnerability in Eclipse Theia, published on 18 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository with adversarial directory or file names that, when analyzed by the AI agent, would cause the agent to follow attacker-controlled instructions (indirect prompt injection). Combined with other AI chat features available in untrusted workspaces, this enabled attack chains leading to data exfiltration via Markdown image rendering or arbitrary command execution via task definitions.
Which versions are affected by CVE-2026-44688?
14 open source packages ship an affected version, including @theia/ai-chat, @theia/ai-chat-ui and @theia/ai-claude-code. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@theia/ai-chat npm | All versions | 1.71.0 |
@theia/ai-chat npm | All versions | 1.71.0 |
@theia/ai-chat-ui npm | All versions | 1.71.0 |
@theia/ai-chat-ui npm | All versions | 1.71.0 |
@theia/ai-claude-code npm | All versions | 1.71.0 |
@theia/ai-claude-code npm | All versions | 1.71.0 |
8 more packages
@theia/ai-code-completion npm | All versions | 1.71.0 |
@theia/ai-code-completion npm | All versions | 1.71.0 |
@theia/ai-core npm | All versions | 1.71.0 |
@theia/ai-core npm | All versions | 1.71.0 |
@theia/ai-editor npm | All versions | 1.71.0 |
@theia/ai-editor npm | All versions | 1.71.0 |
@theia/ai-ide npm | All versions | 1.71.0 |
@theia/ai-ide npm | All versions | 1.71.0 |
Products include Eclipse Theia.
How do I fix CVE-2026-44688?
Upgrade @theia/ai-chat to 1.71.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-44688 being exploited?
There is no known exploitation of CVE-2026-44688 in the wild and no public exploit code.
Other vulnerabilities in Eclipse Theia
- CVE-2021-34436 XML external entity in Eclipse Theia
- CVE-2020-27224 Cross-site Scripting (XSS) in Eclipse Theia
- CVE-2026-60009 File upload in Eclipse Theia
- CVE-2021-34435 Remote code execution in Eclipse Theia
- CVE-2026-44691 [Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions
Sources
Also known as GHSA-3jww-hxqj-wfq2.