In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file..
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HEclipse Theia
APPEclipse0.3.9 – 1.8.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2021-34436CRITICAL9.8PL ✓same product
RCE i XXE w Eclipse Theia via theia-xml-extension
CVE-2020-27224CRITICAL9.6PL ✓same product
Eclipse Theia: RCE przez podatność XSS w Markdown Preview
CVE-2026-60009HIGH8.8PL ✓same product
Eclipse Theia — nieuwierzytelniony arbitrary file write z możliwością RCE
CVE-2026-12609HIGH7.5PL ✓same product
Eclipse Theia — path traversal w endpoincie hostedPlugin umożliwia odczyt plików
CVE-2026-61891HIGH7.5PL ✓same product
Eclipse Theia: nieuwierzytelniony odczyt plików przez path traversal w endpointach HTTP