{"id":"CVE-2026-44691","title":"[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions","summary":"[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions","severity":"high","cwe":["CWE-829"],"vendor":"theia","product":"@theia/debug","ecosystem":"npm","affected":["@theia/debug < 1.69.0","@theia/task < 1.69.0","@theia/workspace < 1.69.0"],"patched":["@theia/debug 1.69.0","@theia/task 1.69.0","@theia/workspace 1.69.0"],"published":"2026-06-18","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-g9jw-92q7-g7fj","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44691"},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/116"},{"url":"https://github.com/eclipse-theia/theia/issues/16889"},{"url":"https://github.com/eclipse-theia/theia/pull/16917"},{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/331"},{"url":"https://github.com/advisories/GHSA-g9jw-92q7-g7fj"}],"tags":["ghsa","npm"],"epss":0.00408,"epssPercentile":0.34854,"ingestedAt":"2026-06-29T13:24:35.696Z","slug":"CVE-2026-44691","body":"## Overview\n\nIn Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user's privileges. In combination with AI chat features and a workspace .theia/settings.json that disabled tool confirmation, this could be triggered automatically by sending a message in the AI chat.\n\n## Affected packages\n\n- `@theia/debug < 1.69.0`\n- `@theia/task < 1.69.0`\n- `@theia/workspace < 1.69.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `@theia/debug 1.69.0`\n- `@theia/task 1.69.0`\n- `@theia/workspace 1.69.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}