Eclipse Theia's Agent Mode wrote outside the workspace: CVE-2026-82217 scores 8.8 for unchecked model-supplied file paths

NVD·high signalXBlueskyLinkedInCopy link

Theia 1.73.0 up to but excluding 1.75.0 resolved paths from writeFileContent, suggestFileContent and their replacement/state helpers with no workspace-containment check, so a model-supplied `../.bashrc`, absolute path or `~`-expanded path wrote or deleted files as the Theia backend OS user. Because the path argument comes from model output, indirect prompt injection steers it, and Agent Mode applies writes without a per-file prompt. Published 31 August 2026; this is the same class as the Hermes auth.json overwrite reported two days earlier, which suggests agent file tools are still shipping without a containment check as the default posture.