Medium severity · published Aug 5, 2026
CVE-2026-14574
In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values without rejecting…
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values without rejecting prototype-related keys (`__proto__`, `constructor`, `prototype`). Because this function is invoked by `PreferenceServiceImpl.doResolve` for every preference resolution across scopes (default, user, workspace, folder), a crafted preference value in a workspace settings file (`.theia/settings.json` or `.vscode/settings.json`) can pollute `Object.prototype` when the user opens the workspace, potentially altering application logic across the Theia process.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ET
Eclipse Theia · Eclipse Foundation
0.7.0 before 1.74.0 · source: vendor
TH
Theia · Eclipse
0.7.0 before 1.74.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-14574
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-14574
Broken Link
https://github.com/eclipse-theia/theia/security/advisories/GHSA-f3w9-qfw3-xr32
Vendor Advisory
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/157
Exploit
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/567
Exploit
https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/567
More from Eclipse Theia
8.8
CVE-2026-82217
In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replacement and state…
8.8
CVE-2026-60009
In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment
8.8
CVE-2026-10054
In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id)…
8.8
CVE-2026-44691
In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g
8.8
CVE-2026-46580
In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI…