https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T11:40:12.424575+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-328645 EUVD-2026-328645 2026-10-04T11:40:12.476981+00:00 EUVD-2026-328645 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44691 fkie_cve-2026-44691 2026-10-04T11:40:12.477019+00:00

In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user's privileges. In combination with AI chat features and a workspace .theia/settings.json that disabled tool confirmation, this could be triggered automatically by sending a message in the AI chat.

 https://cve.radiocsirt.org/vuln/ghsa-g9jw-92q7-g7fj GHSA-g9jw-92q7-g7fj — [Eclipse Theia] Arbitrary Command Execution via Untrusted Workspace Task Definitions 2026-10-04T11:40:12.477055+00:00

Affected: npm: @theia/debug, npm: @theia/task, npm: @theia/workspace

In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user's privileges. In combination with AI chat features and a workspace .theia/settings.json that disabled tool confirmation, this could be triggered automatically by sending a message in the AI chat.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44691 UBUNTU-CVE-2026-44691 2026-10-04T11:40:12.477086+00:00

Affected: Ubuntu:16.04:LTS: eclipse, Ubuntu:18.04:LTS: eclipse

In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user's privileges. In combination with AI chat features and a workspace .theia/settings.json that disabled tool confirmation, this could be triggered automatically by sending a message in the AI chat.