CVE-2026-14574 PUBLISHED

Assigner: eclipse
Reserved: 03.07.2026 Published: 05.08.2026 Updated: 05.08.2026

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the PreferenceUtils.merge function in @theia/core recursively merges preference values without rejecting prototype-related keys (__proto__, constructor, prototype). Because this function is invoked by PreferenceServiceImpl.doResolve for every preference resolution across scopes (default, user, workspace, folder), a crafted preference value in a workspace settings file (.theia/settings.json or .vscode/settings.json) can pollute Object.prototype when the user opens the workspace, potentially altering application logic across the Theia process.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:L/SA:L
CVSS Score: 5.7

Product Status

Vendor Eclipse Foundation
Product Eclipse Theia
Versions Default: unaffected
  • affected from 0.7.0 to 1.74.0 (excl.)

Credits

  • Wu Junming (https://gitlab.eclipse.org/dremig) finder

References

Problem Types

  • CWE-1321 CWE

Impacts

  • CAPEC-77