01 Record

CVE-2026-19884

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia

HighPUBLISHEDCNA: eclipse

Base score8.4 CVSS v4.0CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

View raw JSON CVE Program record

02 Description

In Eclipse Theia versions up to and including 1.69.0, opening a folder starts source control integration without requiring the user to trust the folder first. This affects applications built on Theia

03 Metadata

Published: 2026-08-14 15:32Z3 HR AGO
Last updated: 2026-08-14 15:32Z3 HR AGO
Reserved: 2026-08-14
Assigning CNA: eclipse
Record state: PUBLISHED
Severity: High (CVSS 8.4)
CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses: CWE-15 CWE-829
SSVC decision: No CISA-ADP assessment
Data version: 5.2
Document digest: bd28044158e97dd637364c211a4e2700f035aeb05905b0b859633e8409c59173

04 Affected products

VendorProductVersionsPlatforms

Eclipse FoundationEclipse Theia0 to < 1.70.0—

05 References

github.comhttps://github.com/eclipse-theia/theia/pull/16809
github.comhttps://github.com/eclipse-theia/theia/pull/17098
github.comhttps://github.com/eclipse-theia/theia/pull/17148
gitlab.eclipse.orghttps://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/175
gitlab.eclipse.orghttps://gitlab.eclipse.org/security/cve-assignment/-/work_items/231