What is CVE-2026-22551?

CVE-2026-22551 is a medium-severity vulnerability in Eclipse Theia, classified under Insertion of Sensitive Information into Sent Data. CVSS score: 6.5/10. Published 2026-06-18.

How severe is CVE-2026-22551?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Eclipse Theia

CVE-2026-22551

In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an att…

EPSS: 0.003 (23.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

Affected products

Eclipse Theia
Eclipse Foundation Theia — versions 0

Weakness classification (CWE)

CWE-201 — Insertion of Sensitive Information into Sent Data
CWE-829 — Inclusion of Functionality from Untrusted Control Sphere

References

emo@eclipse.org (Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2026-22551?: CVE-2026-22551 is a medium-severity vulnerability in Eclipse Theia, classified under Insertion of Sensitive Information into Sent Data. CVSS score: 6.5/10. Published 2026-06-18.
How severe is CVE-2026-22551?: Medium severity. CVSS v3 base score is 6.5 out of 10.