In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and the replacement and state helpers) resolved a model-supplied file path without a workspace-containment check. A crafted relative path such as ../.bashrc, an absolute path, or a ~-expanded path could therefore write or delete files outside the workspace with the privileges of the Theia backend OS user. Because the path argument is influenced by model output, it can be steered through indirect prompt injection, and in Agent Mode writes are applied without a confirmation dialog. Writing to a host-executed file such as a shell startup file or ~/.ssh/authorized_keys can escalate to code execution on the backend.

CVE-2026-82217 affects Eclipse Theia versions 1.73.0 up to but not including 1.75.0. The AI Agent Mode file-change tools (writeFileContent, suggestFileContent, and related helpers) fail to validate that model-supplied file paths remain within the workspace boundary. Attackers can supply crafted relative paths (e.g., ../.bashrc), absolute paths, or tilde-expanded paths to read, write, or delete files outside the workspace with the privileges of the Theia backend OS user. Because the path argument is derived from model output, the vulnerability is exploitable via indirect prompt injection. In Agent Mode, file writes are applied automatically without a user confirmation dialog, removing a key safety gate. Writing to sensitive host-executed files such as shell startup scripts or ~/.ssh/authorized_keys can lead to remote code execution on the backend host. Patches are available in version 1.75.0 and later, with a fix referenced in the linked GitHub commit.