GHSA-qwjm-9c66-w4q4
NoneCVSS
—
EPSS
—
Published
Jun 18, 2026
CISA due date
—
The record
[Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @theia/ai-chat | 0 | 1.71.0 |
| npm | @theia/ai-chat-ui | 0 | 1.71.0 |
| npm | @theia/ai-claude-code | 0 | 1.71.0 |
| npm | @theia/ai-code-completion | 0 | 1.71.0 |
| npm | @theia/ai-core | 0 | 1.71.0 |
| npm | @theia/ai-editor | 0 | 1.71.0 |
| npm | @theia/ai-ide | 0 | 1.71.0 |
Related vulnerabilities
- CVE-2026-22551 In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from… Same vulnerability
- GHSA-m973-pr9r-hp2w [Eclipse Theia] Indirect Prompt Injection via Auto-Loaded Workspace Prompt Template Files… Also affects @theia/ai-chat
- GHSA-3jww-hxqj-wfq2 [Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory… Also affects @theia/ai-chat
- CVE-2026-46580 In Eclipse Theia versions prior to 1.71.0, files matching the pattern… Also affects @theia/ai-chat
- CVE-2026-44688 In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and… Also affects @theia/ai-chat
- CVE-2026-105777 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before… CWE-201
- CVE-2026-107315 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is… CWE-201
- CVE-2026-62088 Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress… CWE-201