CVE-2026-82217 Path traversal in Eclipse Theia
Attackers can exploit prompt injection in Eclipse Theia Agent Mode to write files outside the workspace, potentially achieving code execution on the backend.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-82217?
CVE-2026-82217 is a high-severity path traversal vulnerability in Eclipse Theia, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replacement and state helpers) resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc, an absolute path, or a ~-expanded path could therefore write or delete files outside the workspace with the privileges of the Theia backend OS user. Because the path argument is influenced by model output, it can be steered through indirect prompt injection, and in Agent Mode writes are applied without a confirmation dialog. Writing to a host-executed file such as a shell startup file or ~/.ssh/authorized_keys can escalate to code execution on the backend.
Weakness: CWE-22
Which versions are affected by CVE-2026-82217?
How do I fix CVE-2026-82217?
No fix has been published for CVE-2026-82217 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-82217 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-82217 exists.
Sources
Also known as GHSA-2qmg-qr8r-hr5c.