theia has 4 CVEs on record. The busiest recent month was June 2026 with 4. The most common weakness class is CWE-829 (3). Most affected products: @theia/ai-chat-ui (3), @theia/debug (1).

CVEs per month

Last 12 months, by publish date

1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09

Exploited share: 0% vs 1% corpus
Median CVSS: —
Publish → KEV: —
Last 90 days: 0 prev 4

Weakness classes

Products

@theia/ai-chat-ui 3
@theia/debug 1

Follow theia:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

theia vulnerabilities

CVEs affecting theia, newest first. Open any entry for full detail, references, and exploit status.

4 CVEsRSS

CVE-2026-22551Medium

3mo ago

[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat

▾ Sunlittheia · @theia/ai-chat-uiEPSS 0.31%via GHSA

CVE-2026-44688High

3mo ago

[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat

▾ Twilighttheia · @theia/ai-chat-uiEPSS 0.51%via GHSA

CVE-2026-44691High

3mo ago

[Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions

▾ Twilighttheia · @theia/debugEPSS 0.41%via GHSA

CVE-2026-46580High

3mo ago

[Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files in AI Chat

▾ Twilighttheia · @theia/ai-chat-uiEPSS 0.51%via GHSA