What is CVE-2026-44688?

CVE-2026-44688 is a high-severity vulnerability in Eclipse Theia, classified under Inclusion of Functionality from Untrusted Control Sphere. CVSS score: 8.8/10. Published 2026-06-18.

How severe is CVE-2026-44688?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Eclipse Theia

CVE-2026-44688

In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository wi…

EPSS: 0.005 (40.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Eclipse Theia
Eclipse Foundation Theia — versions 0

Weakness classification (CWE)

CWE-829 — Inclusion of Functionality from Untrusted Control Sphere

References

emo@eclipse.org (Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2026-44688?: CVE-2026-44688 is a high-severity vulnerability in Eclipse Theia, classified under Inclusion of Functionality from Untrusted Control Sphere. CVSS score: 8.8/10. Published 2026-06-18.
How severe is CVE-2026-44688?: High severity. CVSS v3 base score is 8.8 out of 10.