CVE-2026-46580 [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat
Attackers can inject malicious prompts via workspace files to execute arbitrary commands or exfiltrate data when opening untrusted repositories in Eclipse Theia.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-46580?
CVE-2026-46580 is a high-severity code injection vulnerability in Eclipse Theia, published on 18 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing prompt template files that, when the workspace was opened in Theia, replaced the AI's system instructions with attacker-controlled content (indirect prompt injection). Combined with other AI chat features available in untrusted workspaces, this enabled attack chains leading to data exfiltration via Markdown image rendering or arbitrary command execution via task definitions.
Which versions are affected by CVE-2026-46580?
12 open source packages ship an affected version, including @theia/ai-chat, @theia/ai-chat-ui and @theia/ai-claude-code. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@theia/ai-chat npm | All versions | 1.71.0 |
@theia/ai-chat npm | All versions | 1.71.0 |
@theia/ai-chat-ui npm | All versions | 1.71.0 |
@theia/ai-chat-ui npm | All versions | 1.71.0 |
@theia/ai-claude-code npm | All versions | 1.71.0 |
@theia/ai-claude-code npm | All versions | 1.71.0 |
6 more packages
@theia/ai-code-completion npm | All versions | 1.71.0 |
@theia/ai-code-completion npm | All versions | 1.71.0 |
@theia/ai-core npm | All versions | 1.71.0 |
@theia/ai-core npm | All versions | 1.71.0 |
@theia/ai-editor npm | All versions | 1.71.0 |
@theia/ai-editor npm | All versions | 1.71.0 |
Products include Eclipse Theia.
How do I fix CVE-2026-46580?
Upgrade @theia/ai-chat to 1.71.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-46580 being exploited?
There is no known exploitation of CVE-2026-46580 in the wild and no public exploit code.
Other vulnerabilities in Eclipse Theia
- CVE-2021-34436 XML external entity in Eclipse Theia
- CVE-2020-27224 Cross-site Scripting (XSS) in Eclipse Theia
- CVE-2026-60009 File upload in Eclipse Theia
- CVE-2021-34435 Remote code execution in Eclipse Theia
- CVE-2026-44688 [Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat
Sources
Also known as GHSA-m973-pr9r-hp2w, UBUNTU-CVE-2026-46580.