GitHub Advisoryadvisory · npm

GHSA-qwjm-9c66-w4q4 [Eclipse Theia] Data Exfiltration via Markdown Image Rendering in AI Chat

MEDIUM Published 2026-06-18 Modified 2026-06-19 Official page ↗
Aliases
CVE-2026-22551
Ecosystem
npm
Packages
@theia/ai-chat-ui, @theia/ai-chat, @theia/ai-claude-code, @theia/ai-code-completion, @theia/ai-core, @theia/ai-editor, @theia/ai-ide
Severity
Moderate
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-201
Reviewed
2026-06-19

Affected packages

• npm @theia/ai-chat-ui: < 1.71.0 → fixed in 1.71.0 • npm @theia/ai-chat: < 1.71.0 → fixed in 1.71.0 • npm @theia/ai-claude-code: < 1.71.0 → fixed in 1.71.0 • npm @theia/ai-code-completion: < 1.71.0 → fixed in 1.71.0 • npm @theia/ai-core: < 1.71.0 → fixed in 1.71.0 • npm @theia/ai-editor: < 1.71.0 → fixed in 1.71.0 • npm @theia/ai-ide: < 1.71.0 → fixed in 1.71.0

Description

In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an attacker could induce the AI agent to construct image URLs encoding sensitive information from the workspace or conversation context, exfiltrating it to attacker-controlled servers. The workspace trust enforcement introduced in v1.71.0 mitigates the documented attack chain by disabling AI features in untrusted workspaces.

Related

Alias · CVE (1)

  • CVE-2026-22551 In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to… vulnerability

Weakness · CWE (1)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness

References