Dashboard / CVE-2026-22551

CVE-2026-22551

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 38/100
Published: 2026-06-18 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Auth Conf. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Active
S: X
AT: None
VC: High
VI: None
VA: None

Description

In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an attacker could induce the AI agent to construct image URLs encoding sensitive information from the workspace or conversation context, exfiltrating it to attacker-controlled servers. The workspace trust enforcement introduced in v1.71.0 mitigates the documented attack chain by disabling AI features in untrusted workspaces.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
eclipse theia < 1.71.0

References & Advisories (1)

Bug Bounty Relevance

38 / 100
✓ No authentication
✓ Low complexity

CVSS Score

6.7 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.31%
Raw Score 0.003120
Percentile 24.1%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00312
2026-10-28
0.00312

Intelligence Sources

nvd ref →

External Links