In Eclipse Theia 0.1.1 to 0.2.0, it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to LemMinX) in order to provide language support for XML. This is installed by default.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HEclipse Theia
APPEclipse0.1.1 – 0.2.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEXXEPath Traversal
Related vulnerabilities
CVE-2020-27224CRITICAL9.6PL ✓same product
Eclipse Theia: RCE przez podatność XSS w Markdown Preview
CVE-2026-61891HIGH7.5PL ✓same product
Eclipse Theia: nieuwierzytelniony odczyt plików przez path traversal w endpointach HTTP
CVE-2026-60009HIGH8.8PL ✓same product
Eclipse Theia — nieuwierzytelniony arbitrary file write z możliwością RCE
CVE-2026-12609HIGH7.5PL ✓same product
Eclipse Theia — path traversal w endpoincie hostedPlugin umożliwia odczyt plików
CVE-2026-44688HIGH8.4same product
In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as p...