What is CVE-2019-17636?

CVE-2019-17636 is a high-severity vulnerability in Eclipse Theia, classified under Insufficient Verification of Data Authenticity. CVSS score: 8.1/10. Published 2020-03-10.

How severe is CVE-2019-17636?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in Eclipse Theia

CVE-2019-17636

In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of files on the host's filesystem, given their path, without restrictions on the requester's origin. This design is vulnerable to being exploited remotely through a DNS rebinding attack or a drive-by download of a carefully crafted exploit.

Published 2020-03-10 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N.

EPSS exploit prediction

EPSS: 0.006 (46.6th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 47th percentile — 46.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000

Affected products

Eclipse Theia
The Eclipse Foundation Theia — versions 0.3.9 to 0.15.0

Weakness classification (CWE)

CWE-345 — Insufficient Verification of Data Authenticity

References

bugs.eclipse.org/bugs/show_bug.cgi (Exploit, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2019-17636?: CVE-2019-17636 is a high-severity vulnerability in Eclipse Theia, classified under Insufficient Verification of Data Authenticity. CVSS score: 8.1/10. Published 2020-03-10.
How severe is CVE-2019-17636?: High severity. CVSS v3 base score is 8.1 out of 10.