theia
v1.77.0Eclipse Theia is a cloud & desktop IDE framework implemented in TypeScript.
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- EPL-2.0Weak copyleft · OSI-approved
- Security
- 6 advisories5 high, 1 medium · Scorecard 5.0/10
- Supported versions
- No scheduleendoflife.date does not track this project
21.8k stars · 2.9k forks · 1.5k open issues · last release 9 days ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 6 most recent advisories published by the maintainers: 5 high, 1 medium. Check the patched version against the one you run.
- highCVE-2026-60009Aug 11, 2026Unauthenticated cross-origin arbitrary file write via /file-upload, escalating to RCE
- Affected
- <= 1.73.1
- Patched in
- 1.74.0
- highCVE-2026-61891Aug 11, 2026Arbitrary file read via unauthenticated file-download endpoints
- Affected
- <= 1.73.1
- Patched in
- 1.74.0
- mediumCVE-2026-14574Aug 11, 2026Prototype Pollution in @theia/core PreferenceService preference merge
- Affected
- >= 1.13.0
- Patched in
- 1.74.0
- highCVE-2026-12609Aug 11, 2026@theia/plugin-ext: Unauthenticated Path Traversal Allows Arbitrary File Read via /hostedPlugin Endpoint
- Affected
- >= 1.66.0
- Patched in
- 1.74.0
- highCVE-2026-10055Jul 3, 2026SSRF and localhost response disclosure via `/services/request-service` RPC in Eclipse Theia
- Affected
- >= 1.26.0
- Patched in
- 1.73.0
- highCVE-2026-10054Jul 3, 2026Cross-Origin WebSocket Access To Shell-Terminal Enables Command Execution And Output Exfiltration
- Affected
- >= 1.8.1; >= 1.8.1
- Patched in
- 1.73.0