CVE-2026-14574

Executive Summary

CVE-2026-14574 is a prototype pollution vulnerability affecting Eclipse Theia, a cloud and desktop IDE framework built on web technologies. Versions 0.7.0 through 1.73.1 inclusive are vulnerable. The flaw exists in the PreferenceUtils.merge function within the @theia/core package, which recursively merges preference values without sanitizing prototype-related keys (__proto__, constructor, prototype). An attacker who can supply a malicious workspace settings file (e.g., .theia/settings.json or .vscode/settings.json) can pollute Object.prototype, leading to integrity compromise of application logic. The vulnerability is rated Medium severity with a CVSS base score of 6.5, reflecting the need for local/user-level access but the high integrity impact resulting from the pollution.

Technical Analysis

The vulnerability resides in the preference resolution mechanism of Eclipse Theia. When a workspace is opened, Theia loads preference values from multiple scopes—default, user, workspace, and folder—and merges them using the PreferenceUtils.merge function. This function performs a recursive object merge operation without checking for dangerous property names.

The affected code path begins with PreferenceServiceImpl.doResolve, which calls PreferenceUtils.merge for every preference resolution. The merging logic likely uses an algorithm similar to:

function merge(target, source) {
  for (const key in source) {
    if (typeof source[key] === 'object' && source[key] !== null) {
      if (!target[key]) target[key] = {};
      merge(target[key], source[key]);
    } else {
      target[key] = source[key];
    }
  }
  return target;
}

This naive recursive merge fails to reject keys such as __proto__, constructor, and prototype. When an attacker supplies a preference value containing "__proto__": {"pollutedKey": "maliciousValue"}, the merge operation assigns to Object.prototype.pollutedKey, polluting the global object prototype across the entire Theia process.

The attack surface is the workspace settings files that Theia reads upon opening a project. An attacker can craft a malicious repository that includes a tricked .theia/settings.json or .vscode/settings.json. When a victim clones and opens this repository in Theia, the settings are parsed and merged, triggering the pollution.

The vulnerability is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N indicates a network-accessible attack vector (the malicious file can be delivered via network), low attack complexity, low privileges required (the attacker must be able to deliver a workspace file), no user interaction, and unchanged scope. The impact is complete loss of integrity with no confidentiality or availability impact.

Exploitation Scenarios

Step 1: Reconnaissance and Target Identification

An attacker identifies targets by searching public code repositories (e.g., GitHub, GitLab) for projects that are built or maintained using Eclipse Theia. Alternatively, the attacker can use search engines with dorks such as "Theia" "settings.json" to find publicly accessible workspaces. For enterprise environments, the attacker may identify developers who use Theia-based IDE products (e.g., Gitpod, Theia Cloud instances) by monitoring job postings or public developer profiles that mention these tools.

Step 2: Crafting the Malicious Workspace

The attacker creates a malicious repository (or modifies an existing one) containing a .theia/settings.json file with the following payload:

{
  "__proto__": {
    "isAdmin": true,
    "validateToken": "return true",
    "bypassAuth": "1"
  },
  "constructor": {
    "prototype": {
      "toString": "function(){ return 'polluted'; }"
    }
  }
}

The attacker also embeds a README or project code that encourages the victim to clone the repository (e.g., a popular library, a compromised open-source project, or a phishing repository).

Step 3: Delivery and Trigger

The attacker delivers the repository via:

• A public repository that appears legitimate and useful
• A compromised legitimate repository (supply chain attack)
• A direct link in a phishing email or chat message to a developer

When the victim clones the repository and opens it in Eclipse Theia (or a Theia-based IDE), the IDE reads .theia/settings.json. The PreferenceServiceImpl.doResolve process calls PreferenceUtils.merge, which processes the __proto__ key and pollutes Object.prototype.

Step 4: Post-Exploitation Impact

Once Object.prototype is polluted, every JavaScript object in the Theia process inherits the polluted properties. The attacker can:

• Bypass authentication checks: If any internal code checks if (user.isAdmin) or similar, the inherited isAdmin: true property causes the check to pass for all users.
• Alter application logic: Polluted toString, hasOwnProperty, or other Object methods can be overridden to return unexpected values, breaking or redirecting application flow.
• Exfiltrate data: The attacker can override methods like JSON.stringify or getters to intercept sensitive data flowing through the IDE.
• Achieve code execution: In combination with gadgets in the Theia codebase (e.g., a function that uses a polluted property as a sink), the attacker may achieve arbitrary code execution within the Theia process, potentially leading to remote code execution if Theia is exposed via a web interface.

Impact Assessment

The business impact of CVE-2026-14574 is significant for organizations using Eclipse Theia-based IDEs, cloud development environments (e.g., Gitpod, Eclipse Che), or custom Theia applications.

Confidentiality Impact (C: None): The vulnerability does not directly expose data, but the pollution can be leveraged to bypass access controls that protect sensitive data.

Integrity Impact (I: High): This is the primary impact. Prototype pollution can alter application logic, security checks, and data validation across the entire Theia process. An attacker can manipulate preferences, bypass authorization, and inject malicious behavior into the IDE.

Availability Impact (A: None): The vulnerability does not directly cause denial of service, though polluted objects could potentially be used to crash the application through deliberate misconfiguration.

Affected Systems: All Eclipse Theia installations from version 0.7.0 through 1.73.1. This includes:

• Standalone Theia IDE installations
• Theia-based cloud IDEs (Gitpod, Eclipse Che, Google Cloud Shell)
• Custom enterprise IDE deployments built on Theia

Blast Radius: Any user who opens an untrusted workspace in Theia is at risk. In enterprise environments where multiple developers work on shared codebases, a single malicious repository can compromise multiple developers' IDE sessions. For cloud IDE providers, a compromise could affect all users on a shared Theia instance.

CVSS Sub-scores: The CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N yields a base score of 6.5, classified as Medium. The low privilege requirement (PR:L) reflects that the attacker must have the ability to deliver a workspace file. The high integrity impact and network attack vector make this particularly concerning for cloud-based IDE services.

Detection Guidance

Sigma Rule

title: Eclipse Theia Prototype Pollution via Workspace Settings
id: 9f5c1a3e-7b42-4d8a-9c1f-2e6b3d7a9f01
status: experimental
description: Detects workspace settings files containing prototype pollution indicators
author: Valtersit SOC
date: 2026/01/15
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '\settings.json'
      - '\\.theia\\settings.json'
      - '\\.vscode\\settings.json'
    TargetFilename|startswith:
      - 'C:\workspaces\'
      - 'D:\workspaces\'
  keywords:
    - '__proto__'
    - 'constructor.prototype'
    - '"prototype"'
  condition: selection and keywords
level: high
falsepositives:
  - Legitimate settings files using JSON schema validation that includes prototype keys (rare)
tags:
  - attack.t1190
  - cve.2026.14574
  - cwe.1321

YARA Rule

rule CVE_2026_14574_Theia_Prototype_Pollution {
    meta:
        author = "Valtersit SOC"
        description = "Detects workspace settings files containing prototype pollution payloads for CVE-2026-14574"
        cve = "CVE-2026-14574"
        cwe = "CWE-1321"
        date = "2026-01-15"
        severity = "medium"
    strings:
        $proto1 = "__proto__"
        $proto2 = "constructor"
        $proto3 = "prototype"
        $json_ext = ".json"
        $theia_dir = ".theia"
        $vscode_dir = ".vscode"
        $settings = "settings.json"
    condition:
        (#proto1 >= 1 or #proto2 >= 1) and
        (#proto3 >= 1) and
        ($settings) and
        ($json_ext) and
        (any of ($theia_dir, $vscode_dir))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-14574 Eclipse Theia Prototype Pollution Attempt"; flow:established,to_server; content:"__proto__"; nocase; http_client_body; classtype:attempted-admin; sid:2026074; rev:1; metadata:created_at 2026_01_15, cve CVE-2026-14574, cwe CWE-1321;)

alert http any any -> any any (msg:"CVE-2026-14574 Eclipse Theia Settings File Download"; flow:established,to_client; content:"settings.json"; http_uri; content:".theia"; http_uri; nocase; content:"__proto__"; nocase; http_server_body; classtype:attempted-admin; sid:2026075; rev:1; metadata:created_at 2026_01_15, cve CVE-2026-14574, cwe CWE-1321;)

Elastic Detection

sequence with maxspan=5m
  [file where event.action == "creation" and
     (file.name == "settings.json" and
      (file.path contains ".theia" or file.path contains ".vscode")) and
     process.name in ("node", "theia", "theia-electron")
  ]
  [process where event.type == "start" and
     process.args contains "settings.json" and
     process.args contains "merge"]

Splunk SPL Query

index=main sourcetype=filesystem
| search (file_path="*\.theia\settings.json" OR file_path="*\.vscode\settings.json")
| search "__proto__" OR "constructor.prototype" OR "\"prototype\""
| stats count by host, user, file_path, sourcetype
| sort - count

Wazuh OSSEC Rule

<group name="eclipse,theia,prototype_pollution,">
  <rule id="100274" level="10">
    <if_sid>550</if_sid>
    <field name="file">\.theia/settings\.json$|\.vscode/settings\.json$</field>
    <field name="file.">__proto__|constructor\.prototype|"prototype"</field>
    <description>CVE-2026-14574: Eclipse Theia settings file with prototype pollution indicators detected: $(file)</description>
    <group>attack.t1190,cwe.1321,cve.2026.14574,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed))

The NVD description states the vulnerability affects versions "up until including 1.73.1", implying a patched version exists at version 1.74.0 or later. However, this patch has not been independently confirmed, and the vendor fix is listed as "N/A" in the CVE data. Exercise caution and verify the patch independently before deployment.

1) Immediate Mitigations (Apply Now)

• Restrict workspace access: Do not open untrusted or unsolicited repositories in Eclipse Theia. Validate repositories before cloning, especially from unknown or newly created sources.
• Audit settings files: Before opening a workspace, review .theia/settings.json and .vscode/settings.json for suspicious __proto__, constructor, or prototype keys.
• Disable workspace settings inheritance: If your Theia configuration supports it, disable automatic loading of workspace-level settings files, forcing users to explicitly approve them.
• Implement filesystem monitoring: Deploy detection rules (as provided in this report) to alert on malicious settings file creation or modification.

2) Patch/Upgrade Steps

• Upgrade Eclipse Theia: Update @theia/core and all dependent Theia packages to version 1.74.0 or later if confirmed available. Use the package manager appropriate for your Node.js environment:

  npm update @theia/core @theia/workspace @theia/preferences
  # or
  yarn upgrade @theia/core
  # or
  pnpm update @theia/core
  

• Verify the patch: After upgrading, verify that PreferenceUtils.merge now rejects prototype-related keys. Independently confirm the fix by reviewing the changelog or testing with a controlled malicious settings file.
• Check for backports: If your Theia distribution is maintained by a vendor (e.g., Gitpod, Eclipse Che), check for vendor-specific security updates.

3) Long-Term Hardening

• Implement secure object merging: If you maintain custom Theia extensions or plugins, ensure all merge functions sanitize keys, rejecting __proto__, constructor, and prototype.
• Use frozen prototypes: In Node.js deployments, consider freezing Object.prototype with Object.freeze(Object.prototype) where practical, to prevent any pollution attempts.
• Monitor for CVE updates: Continuously monitor NVD, the Eclipse Theia security advisory, and vendor channels for independent confirmation of the patch and any additional affected versions.
• Security awareness training: Educate developers about the risks of opening untrusted repositories and the specific threat posed by malicious .theia/settings.json files.
• Isolate IDE environments: Run Theia in containerized environments with restricted filesystem access to limit the impact of a successful prototype pollution exploit.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-14574
2. Eclipse Theia GitHub: https://github.com/eclipse-theia/theia — Monitor for the patched version release and security advisories.
3. CWE-1321 Reference: https://cwe.mitre.org/data/definitions/1321.html — Improperly Controlled Modification of Object Prototype Attributes.
4. CISA KEV: CVE-2026-14574 is not listed in the CISA Known Exploited Vulnerabilities catalog as of the date of this report. No active exploitation in the wild has been confirmed.

Known Threat Actor Campaigns: No specific threat actor campaigns have been publicly attributed to CVE-2026-14574 at the time of writing. The EPSS score of 0.00148 (4.5th percentile) indicates a low probability of active exploitation. However, the availability of public PoC/exploit code (classified as "Public" in the CVE data) increases the risk of weaponization. The lack of a Nuclei template and absence from CISA KEV suggest this vulnerability has not yet been broadly incorporated into automated exploit frameworks.