CVE-2026-19884

Executive Summary

CVE-2026-19884 is an arbitrary command execution vulnerability affecting Eclipse Theia versions up to and including 1.69.0. When a user opens a folder in a Theia-based application that includes git integration, the IDE automatically runs git commands against the contained repository without first prompting the user to trust the folder. An attacker can embed a malicious git configuration that causes a developer's machine to execute arbitrary commands with the privileges of the user, with no confirmation prompt. The issue is resolved in Theia 1.70.0, which gates plugin loading/activation in untrusted workspaces and removes the deprecated @theia/git extension.

Technical Analysis

The root cause of CVE-2026-19884 is a missing workspace trust gate combined with the eager execution of source control integration. In Theia 1.69.0 and earlier, opening a folder immediately triggers source control integration — no trust prompt is shown to the user first. Applications built on Theia that include git integration, such as the Theia IDE, are affected. Both @theia/git and the built-in VS Code git extension run git commands such as git status as soon as a repository is detected in the opened folder.

The exploitation mechanism relies on git's behavior of honoring repository-local configuration. Git reads .git/config from the repository working tree and applies its settings. An attacker-controlled .git/config can set core.fsmonitor (or a comparable hook-like setting such as a pager, filter, or external diff driver) to point to an arbitrary executable. When git runs its normal status/repository operations, it invokes the configured command, resulting in arbitrary command execution.

The malicious repository can be delivered using the technique described in OVE-20210718-0001: burying a bare repository inside a regular repository. In this layout, the outer repository appears benign during cloning, while the inner bare repository's configuration (including .git/config) is controlled by the attacker. Cloning an attacker-supplied repository and opening it in a Theia-based application is therefore sufficient to trigger command execution — no additional user interaction, confirmation prompt, or trust decision is required.

The fix, introduced in Theia 1.70.0, leverages the existing untrusted workspace capability model: plugins that declare capabilities.untrustedWorkspaces.supported: false — which includes the built-in git extension — are no longer loaded or activated when the workspace is untrusted. Furthermore, the deprecated @theia/git extension was removed, meaning no git command is executed against an untrusted folder at all. This effectively closes the untrusted-configuration attack surface for git operations.

The vulnerability is classified under CWE-15 (External Control of System or Configuration Setting): the attacker controls a configuration file that the vulnerable application reads and acts upon, leading to command execution. No CVSS vector has been assigned (N/A), so no CVSS sub-scores are available for impact calculation.

Exploitation Scenarios

The attack chain for CVE-2026-19884 is as follows:

1. Reconnaissance / target identification. The attacker identifies a target that uses a Theia-based IDE or a Theia-built web application with git integration. Theia-based products often expose web UIs, so an attacker may also serve a malicious repository from a legitimate-looking hosting service, share it via a link, or embed it in an open-source project that the target is likely to clone. Social engineering may be used to persuade the developer to clone and open the repository.

2. Flaw class trigger. The attacker crafts a repository that contains a malicious .git/config file. Using the OVE-20210718-0001 technique, a bare repository is buried inside an outer regular repository so that the clone operation itself does not raise suspicion. When the victim clones and opens the folder in Theia 1.69.0 or earlier, the IDE's git integration automatically detects the repository and runs git status without first requesting folder trust.

3. Payload / execution method. The malicious .git/config sets core.fsmonitor (or a comparable hook-like setting) to reference an attacker-chosen executable. When git executes its repository-status operation, it invokes the configured command. Because the command runs with the privileges of the user running the IDE, the attacker obtains arbitrary code execution on the victim's machine. No confirmation prompt is presented to the user at any point. No public PoC has been confirmed for this CVE; the attack chain is inferred from the vulnerability class and the details in the NVD description.

4. Post-exploitation impact. Once code execution is achieved, the payload runs in the context of the developer's user account. Practical outcomes include theft of source code and intellectual property from the local workspace, access to git credentials and SSH keys used for code hosting platforms, lateral movement within the corporate network using the compromised developer workstation, credential theft from password managers and browser stores, and the planting of backdoors into the developer's toolchain that could be propagated into downstream build artifacts and software releases.

Impact Assessment

The primary business impact is remote code execution on developer workstations — a high-severity scenario in any software development organization. Affected systems are Eclipse Theia versions up to and including 1.69.0 and any Theia-based application that includes git integration, including the Theia IDE. The attack requires only that the user clone and open a malicious repository; this is a routine developer action, making the exploitation barrier low.

The blast radius extends beyond the compromised workstation. Developers' machines typically hold access to source-code repositories, CI/CD pipelines, cloud credentials, and internal development networks. A single successful exploit can serve as a foothold for a supply-chain attack: an attacker who controls a developer workstation can modify source code, introduce malicious dependencies, or tamper with build artifacts. Because the trust model of Theia is bypassed, the usual "I opened a folder in my IDE" assumption of safety is invalidated.

No CVSS score or vector is available for this CVE (N/A), so quantitative severity metrics cannot be cited. The EPSS score of 0.00130 (3.1% percentile of exploited CVEs) suggests that exploitation in the wild is currently not widespread. The CVE is not listed in CISA KEV, and no exploit code or Nuclei template is publicly confirmed at the time of writing. Nevertheless, the vulnerability class (configuration-driven RCE in a widely used developer tool) warrants priority patching in environments where Theia-based IDEs are deployed.

Detection Guidance

The following detections focus on (a) processes spawned by git that indicate execution of hook-like configuration settings, (b) malicious .git/config content, and (c) network indicators associated with fetching attacker-supplied repositories. Tune all rules to the local environment to reduce false positives.

Sigma Rule

title: Git Spawning Suspicious Child Process from Repository Config
id: c609b8c0-0001-4a1e-9b0c-19884a1e0001
status: experimental
description: Detects git.exe or git process spawning a shell or interpreter,
             consistent with an attacker-controlled hook-like setting
             (e.g., core.fsmonitor) in a malicious .git/config (CVE-2026-19884).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-19884
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\git.exe'
            - '\git'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\sh'
            - '\bash.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
    condition: selection_parent and selection_child
fields:
    - ParentImage
    - Image
    - CommandLine
level: high
falsepositives:
    - Git hooks installed by legitimate tooling (e.g., husky, pre-commit frameworks)
    - Developer scripts invoked via git aliases

YARA Rule

rule CVE_2026_19884_malicious_git_config
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects .git/config files containing hook-like settings
                       that enable arbitrary command execution, as exploited
                       in CVE-2026-19884 (Eclipse Theia untrusted workspace)."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19884"
        date = "2026-01-01"
    strings:
        $s1 = "core.fsmonitor" ascii wide nocase
        $s2 = "core.sshCommand" ascii wide nocase
        $s3 = "core.pager" ascii wide nocase
        $s4 = "core.editor" ascii wide nocase
        $s5 = "filter." ascii wide nocase
        $s6 = ".smudge" ascii wide nocase
        $s7 = ".clean" ascii wide nocase
        $s8 = "diff." ascii wide nocase
        $s9 = "[core]" ascii wide nocase
        $s10 = "[filter" ascii wide nocase
        $s11 = "[diff" ascii wide nocase
    condition:
        uint32(0) == 0x6769742E or filesize < 10KB and
        $s9 and 1 of ($s1, $s2, $s3, $s4, $s5, $s6, $s7, $s8) and
        for any of ($s1, $s2, $s3, $s4, $s6, $s7) : ( # contains absolute path or shell
            filesize > 0
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-19884 Potential Malicious Git Repository Delivery - .git/config Access";
    flow:established,to_server;
    http.uri; content:".git"; http.uri; content:"config"; http.uri; nocase;
    content:"git-upload-pack"; http.uri; nocase;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-19884;
    classtype:attempted-user;
    sid:202619884; rev:1;)

Elastic Detection

process where event.module == "endpoint" and
  process.parent.name in ("git.exe", "git") and
  process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash.exe",
                   "wscript.exe", "cscript.exe", "mshta.exe", "python.exe") and
  not process.command_line : "*legitimate internal hook*"

Splunk SPL Query

index=windows EventCode=4688
| where ParentImage IN ("*\\git.exe", "*/git")
| where NewProcessName IN ("*\\cmd.exe", "*\\powershell.exe", "*\\pwsh.exe",
                           "*\\sh", "*\\bash.exe", "*\\wscript.exe",
                           "*\\cscript.exe", "*\\mshta.exe")
| table _time, host, user, ParentImage, ParentProcessId, NewProcessName, CommandLine
| sort - _time

Wazuh OSSEC Rule

<group name="syscheck,gitconfig,">
  <rule id="859650" level="12">
    <if_sid>550</if_sid>
    <field name="file">\.git\\config$|\.git/config$</field>
    <match>core\.fsmonitor|core\.sshCommand|core\.pager|filter\.|\.smudge|\.clean</match>
    <description>CVE-2026-19884: Malicious .git/config with hook-like setting detected in opened workspace</description>
    <group>eclipse_theia,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence for CVE-2026-19884 is rated 2/4 — the fix is claimed by a single source (OSV) and has not been independently confirmed. Validate the following steps against your own environment before assuming coverage.

1. Immediate mitigations. Upgrade any Eclipse Theia-based application to version 1.70.0 or later as soon as the update is validated; 1.70.0 introduces untrusted-workspace capability gating so plugins that declare capabilities.untrustedWorkspaces.supported: false — including the built-in git extension — are not loaded or activated in untrusted workspaces, and removes the deprecated @theia/git extension entirely. Until the upgrade is complete, instruct developers not to clone and open repositories from untrusted sources, and warn against opening repository bundles, archives, or zip files that contain pre-initialized .git directories. As an additional stopgap, inspect any repository's .git/config for core.fsmonitor and other hook-like settings (core.sshCommand, core.pager, filter.*, diff.*) before opening it in a Theia-based IDE.

2. Patch/upgrade steps. The OSV record for CVE-2026-19884 indicates the package status as unfixed for the root path and lists the fix at Theia 1.70.0; monitor the OSV entry and the official Eclipse Theia release channels for confirmation and for any follow-up advisories. Update all distributable Theia-based products your organization builds or consumes, and re-test after upgrade that git integration no longer executes against untrusted folders. Review any custom Theia plugins you ship to ensure they declare capabilities.untrustedWorkspaces.supported appropriately and do not reintroduce eager command execution.

3. Long-term hardening. Treat IDE workspace trust as a security boundary: enforce folder trust prompts, and prefer products that implement capability-based gating for untrusted workspaces (as Theia 1.70.0 does). Centralize developer endpoint monitoring so that git-spawned processes are logged and alerted via the Sigma/Splunk/Elastic rules above. Add repository configuration scanning to CI or pre-push hooks to block .git/config files containing executable hooks before they reach developers. Regularly review the CISA KEV catalog for CVE-2026-19884, since KEV status can change if in-the-wild exploitation is confirmed.

References

1. NVD — CVE-2026-19884: https://nvd.nist.gov/vuln/detail/CVE-2026-19884
2. OSV — CVE-2026-19884 vulnerability record (patch source, package status): https://osv.dev/vulnerability/CVE-2026-19884
3. Eclipse Theia project repository and release notes for 1.70.0 (untrusted workspace capability gating, @theia/git removal): https://github.com/eclipse-theia/theia
4. OVE-20210718-0001 — technique for burying a bare repository inside a regular repository, referenced by the NVD description as the delivery mechanism.

No CISA KEV listing applies to CVE-2026-19884 as of the time of writing, and no confirmed threat-actor campaigns or exploit-in-the-wild evidence is available. PoC/exploit status is unknown; no public exploit code or Nuclei template exists.