CVE-2026-22551 – Eclipse Theia Improper Neutralization of Special Elements used in an Image URI (Image Path Traversal)

CVE ID :CVE-2026-22551

Published : June 18, 2026, 2:32 p.m. | 1 hour, 10 minutes ago

Description :In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an attacker could induce the AI agent to construct image URLs encoding sensitive information from the workspace or conversation context, exfiltrating it to attacker-controlled servers. The workspace trust enforcement introduced in v1.71.0 mitigates the documented attack chain by disabling AI features in untrusted workspaces.

Severity: 6.7 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…