TH
Product
Theia
15
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 8Medium 5Low 0
Watch
Add Theia to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-60009 | 8.8 | Aug 5 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment Affected: before 1.74.0 |
| CVE-2026-44691 | 8.8 | Jun 18 | In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g Affected: before 1.69.0 |
| CVE-2026-46580 | 8.8 | Jun 18 | In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI… Affected: before 1.71.0 |
| CVE-2026-44688 | 8.8 | Jun 18 | In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system… Affected: before 1.71.0 |
| CVE-2021-34435 | 8.8 | Sep 1 | In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE Affected: 0.3.9 through 1.8.1 |
| CVE-2019-17636 | 8.1 | Mar 10 | In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com Affected: 0.3.9 through 0.15.0 |
| CVE-2026-61891 | 7.5 | Aug 5 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert… Affected: before 1.74.0 |
| CVE-2026-12609 | 7.5 | Aug 5 | In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the… Affected: 1.66.0 before 1.74.0 |
Showing 8