CVE-2026-82217

Executive Summary

CVE-2026-82217 is a high-severity path traversal vulnerability (CVSS 8.8) affecting Eclipse Theia versions 1.73.0 through 1.74.x. The AI "Agent Mode" file-change tools fail to enforce workspace-containment checks when resolving model-supplied file paths, allowing a crafted relative path (e.g., ../.bashrc), an absolute path, or a ~-expanded path to write or delete files outside the intended workspace with the privileges of the Theia backend OS user. Because the path argument is influenced by model output, this flaw can be weaponized via indirect prompt injection, and in Agent Mode, writes are applied without a confirmation dialog. Successful exploitation can lead to arbitrary file write/delete on the backend host, escalating to remote code execution when targeting host-executed files such as shell startup files or ~/.ssh/authorized_keys. No patch is currently available.

Technical Analysis

The vulnerability resides in Eclipse Theia's AI "Agent Mode" feature, introduced in version 1.73.0. Agent Mode extends the IDE with autonomous AI capabilities, including file modification tools that operate on the user's behalf. Three specific functions are implicated per the NVD description: writeFileContent, suggestFileContent, and associated replacement/state helpers. These tools accept a file path argument that is supplied by the AI model's output — meaning the path originates from a language model response rather than from direct user input or a constrained UI control.

The core flaw is a missing workspace-containment check. When the tools resolve the provided path, they do not verify that the resolved canonical path remains within the confines of the currently opened workspace directory. This absence of validation permits three categories of malicious paths:

1. Relative path traversal — A path such as ../.bashrc traverses upward from the workspace root into the parent directory structure, potentially reaching the user's home directory or other system areas.
2. Absolute paths — A path such as /etc/cron.d/malicious bypasses containment entirely by specifying a fully qualified system path.
3. Tilde-expanded paths — A path such as ~/.ssh/authorized_keys triggers shell tilde expansion to the backend OS user's home directory.

The security boundary being violated is the trust boundary between the IDE workspace (where the user expects the AI to operate) and the broader filesystem (which the AI should never touch). The affected functions perform write and delete operations with the privileges of the Theia backend process user — which, in typical IDE deployments (e.g., remote development containers, cloud workspaces, or self-hosted Theia instances), is a regular OS user but one with full access to that user's files, including shell startup scripts, SSH keys, and cron configurations.

Critically, the path argument is derived from model output. In modern AI-assisted coding workflows, the model processes context that may include untrusted data — for example, code snippets fetched from the internet, documentation pasted from external sites, or repository contents cloned from public sources. An attacker can embed crafted instructions within such content (indirect prompt injection) that cause the model to issue file operations targeting paths outside the workspace. Because Agent Mode applies writes automatically without a confirmation dialog, there is no user-approval step to intercept the malicious operation.

The vulnerability class is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The attack surface is significant: any user running a vulnerable Theia version who activates Agent Mode and allows the AI to process external content becomes a potential target. The backend process is typically network-accessible in remote/cloud deployment scenarios, widening the exposure.

Exploitation Scenarios

Scenario 1: Indirect Prompt Injection Leading to Arbitrary File Write

1. Reconnaissance/target identification: An attacker identifies a target using Eclipse Theia 1.73.0–1.74.x with Agent Mode enabled. This could be a developer workstation, a self-hosted IDE instance, or a cloud development environment. The attacker may probe for Theia via HTTP headers, login pages, or characteristic API endpoints.
2. Triggering the flaw: The attacker crafts malicious content — such as a poisoned code repository, a malicious README file, or a compromised npm package — that embeds prompt injection instructions. When the victim opens this content in Theia and the AI Agent processes it (e.g., the model is asked to summarize, refactor, or explain the code), the injected instructions direct the model to call writeFileContent with a path like ../.bashrc or ~/.ssh/authorized_keys.
3. Payload/execution method: Because the model's output is treated as trusted tool input without workspace-containment validation, the path resolves outside the workspace. The tool writes the model-generated content (which can include attacker-controlled text from the injected instructions) to the target file. In the case of ~/.ssh/authorized_keys, the attacker embeds their own SSH public key. For .bashrc or .zshrc, the attacker embeds a reverse-shell command or other persistence mechanism.
4. Post-exploitation impact: Once the file is written, the attacker either connects via SSH using the planted key or triggers the shell startup file on the victim's next login. This results in arbitrary code execution with the privileges of the Theia backend OS user. The attacker can then move laterally, exfiltrate source code, steal credentials, or pivot deeper into the network.

Scenario 2: Destructive File Deletion

1. Reconnaissance/target identification: Same target identification as above, but the attacker's goal is destructive rather than covert access.
2. Triggering the flaw: The attacker injects instructions that cause the model to invoke the deletion helper (the replacement/state helper) with paths like ../../etc/nginx/sites-enabled/default or ~/Documents/ to delete critical configuration or user data.
3. Payload/execution method: The model issues a delete operation on the resolved absolute or traversed path. No containment check blocks the operation, and no confirmation dialog appears in Agent Mode.
4. Post-exploitation impact: Deletion of critical files results in denial of service, data loss, or system misconfiguration. Repeated incidents could render the development environment or host services inoperable.

Note: No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description. The absence of a confirmation dialog and the model-influenced path parameter are the key exacerbating factors.

Impact Assessment

The CVSS score of 8.8 (High) reflects the severity of this vulnerability. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates:

• Attack Vector: Network — The vulnerability can be triggered remotely if the Theia instance accepts external content (e.g., via cloned repositories or fetched URLs).
• Attack Complexity: Low — No special conditions are required beyond having the victim open crafted content in Agent Mode.
• Privileges Required: None — The attacker needs no prior access to the target.
• User Interaction: Required — The victim must open the malicious content and interact with the AI Agent (though the injection makes this interaction seem innocuous).
• Confidentiality, Integrity, Availability Impact: High — All three impact dimensions are rated high.

Business impact: For enterprises using Eclipse Theia as their primary development environment (particularly in remote/cloud IDE setups), this vulnerability enables remote code execution on developer machines or backend servers. The compromise of a developer workstation can expose proprietary source code, API keys, cloud credentials, and can serve as an entry point for supply-chain attacks — malicious code could be injected into the codebase the developer is working on. The path traversal also enables data destruction, causing operational disruption.

Blast radius: Any file accessible by the Theia backend OS user is at risk. This includes shell configuration files, SSH keys, cron jobs, web server configurations, and any application data visible to that user. In containerized deployments, the same filesystem restrictions apply as the container user's privileges. In misconfigured deployments where Theia runs with elevated privileges, the impact escalates to full system compromise.

The AI agent context expands the attack surface: because the path is derived from model output, an attacker doesn't need to directly interact with the IDE — they only need to poison content the model consumes. This indirect attack surface is significantly broader than traditional path traversal vectors.

Detection Guidance

Detection of this vulnerability is challenging because legitimate Agent Mode activities use the same writeFileContent and related tools. The key differentiators are: (1) paths resolving outside the workspace root, (2) writes to sensitive system files, and (3) suspicious model behavior patterns. The rules below focus on detecting the anomalous path resolution and the resulting file access patterns.

Sigma Rule

title: Eclipse Theia Agent Mode Path Traversal - File Write Outside Workspace
id: 8a3c7f2e-5b91-4d6a-9e42-c7e1d9a3f5b2
status: experimental
description: Detects file write operations by Eclipse Theia Agent Mode tools that resolve paths outside the workspace directory, indicating potential CVE-2026-82217 exploitation via path traversal.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-82217
author: Valtersit Threat Intelligence
date: 2026/04/10
logsource:
    category: file_event
    product: linux
detection:
    selection_theia_process:
        Image|endswith:
            - 'theia'
            - 'node'
            - 'theia-backend'
    selection_sensitive_paths:
        TargetFilename|contains:
            - '/.ssh/'
            - '/.bashrc'
            - '/.zshrc'
            - '/.profile'
            - '/etc/cron'
            - '/etc/rc'
    selection_module_name:
        Image|contains: 'theia'
    condition: selection_theia_process and selection_module_name and selection_sensitive_paths
    timeframe: 5m
level: critical
falsepositives:
    - Legitimate user-directed file operations from Agent Mode to system files (highly unlikely in normal usage)
    - File writes performed by the user directly in the IDE (not via Agent Mode tools)
tags:
    - attack.t1190
    - attack.t1565
    - cve.2026-82217

YARA Rule

rule Eclipse_Theia_Agent_Mode_Path_Traversal_Payloads
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects malicious payload patterns targeting CVE-2026-82217 in Eclipse Theia — path traversal strings and shell startup manipulation used to exploit the Agent Mode file tools."
        date = "2026-04-10"
        cve = "CVE-2026-82217"
        severity = "high"
    strings:
        // Path traversal patterns
        $traversal_deep = /(?i)(\.\.\/){2,}[^\n]{0,100}/ ascii
        $traversal_single = /(?i)\.\.\/\.bashrc/ ascii
        $traversal_ssh = /(?i)\.\.\/\.ssh\/authorized_keys/ ascii
        $traversal_home = /(?i)\.\.\/home\/[a-z0-9_\-]{1,32}\/[^\n]{0,80}/ ascii
        
        // Shell payload indicators
        $bash_rc_payload = /(?i)(bash -i|nc\s+-e|ncat\s+--sh-exec|curl\s+[^\s]+\s*\|\s*(ba)?sh|wget\s+[^\s]+\s*\|\s*(ba)?sh)/ ascii
        
        // SSH authorized_keys manipulation
        $ssh_key_comment = /ssh-rsa\s+AAAA[0-9A-Za-z+\/]{16,}/ ascii
        
        // Theia API function references
        $write_file_api = "writeFileContent(" ascii
        $replace_helper = "replaceFileContent(" ascii
        $state_helper = "agentModeState" ascii

    condition:
        uint16(0) == 0x7B7B or  // {{ — config/trigger file format
        filesize < 500KB and
        (
            (1 of ($traversal*) and 1 of ($bash_rc_payload*)) or
            (1 of ($traversal*) and 1 of ($ssh_key_comment)) or
            ($write_file_api and 1 of ($traversal*)) or
            ($write_file_api and $bash_rc_payload) or
            ($replace_helper and 1 of ($traversal*))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82217 - Eclipse Theia Agent Mode Path Traversal Attempt"; flow:established,to_server; content:"writeFileContent"; http_raw_body; nocase; pcre:"/(\.\.\/|~\/|\/[a-z0-9_]+\/\.\.\/)/iR"; metadata:cve CVE-2026-82217; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-82217; classtype:attempted-admin; sid:2008221701; rev:1;)

alert http any any -> any any (msg:"CVE-2026-82217 - Eclipse Theia Agent File Path Suggests Workspace Escape"; flow:established,to_server; content:"suggestFileContent"; http_raw_body; nocase; pcre:"/(\.\.\/\.bashrc|\.\.\/\.ssh\/authorized_keys|\.\.\/\.zshrc|\.\.\/\.profile|\.\.\/etc\/)/iR"; metadata:cve CVE-2026-82217; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-82217; classtype:attempted-admin; sid:2008221702; rev:1;)

alert http any any -> any any (msg:"CVE-2026-82217 - Eclipse Theia Agent Mode Path Traversal to Sensitive File"; flow:established,to_server; content:"agentMode"; http_raw_body; nocase; pcre:"/(\.\.\/|\/etc\/|\/home\/|\/root\/|\/var\/)/R"; metadata:cve CVE-2026-82217; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-82217; classtype:attempted-admin; sid:2008221703; rev:1;)

Elastic Detection

// EQL rule to detect Eclipse Theia file write/delete operations targeting paths outside the workspace
// Correlation: process spawns file events with path traversal or sensitive file targets
sequence by process.entity_id with maxspan=10s
  [ process where process.name : ("node", "theia", "theia-backend") and
    process.args : ("*writeFileContent*", "*suggestFileContent*", "*replaceFileContent*") ]
  [ file where event.action in ("write", "delete", "modify") and
    (
      file.path : ("*/../*", "*/../../*", "~/.ssh/*", "~/.bashrc", "~/.zshrc", "~/.profile") or
      file.path : ("/etc/cron*", "/etc/rc*", "/root/*", "/home/*/.ssh/*")
    )
  ]

Splunk SPL Query

index=sysmon OR index=endpoint
| where (Image LIKE "%theia%" OR Image LIKE "%node%")
| where (TargetFilename LIKE "%../%" OR TargetFilename LIKE "%~/.ssh%" OR TargetFilename LIKE "%~/.bashrc%" OR TargetFilename LIKE "%etc/cron%" OR TargetFilename LIKE "%etc/rc%")
| where EventType IN ("CREATION", "DELETION", "MODIFICATION") OR Operation IN ("WriteFile", "DeleteFile", "CreateFileTableEntry")
| eval path_traversal = if(TargetFilename LIKE "%../%" OR TargetFilename LIKE "%..%..%", "YES", "NO")
| eval sensitive_target = if(TargetFilename LIKE "%/.ssh/%" OR TargetFilename LIKE "%/.bashrc%" OR TargetFilename LIKE "%/.zshrc%" OR TargetFilename LIKE "%/.profile%" OR TargetFilename LIKE "%/etc/cron%" OR TargetFilename LIKE "%/etc/rc%", "YES", "NO")
| where path_traversal = "YES" OR sensitive_target = "YES"
| stats count by host, process_name, TargetFilename, path_traversal, sensitive_target
| sort - count
| table _time, host, process_name, TargetFilename, path_traversal, sensitive_target, count
| rename TargetFilename AS "Target File Path", process_name AS "Process", path_traversal AS "Path Traversal Indicator", sensitive_target AS "Sensitive File Target"

Wazuh OSSEC Rule

<group name="theia,path_traversal,cve-2026-82217,">
  <rule id="100227" level="12">
    <decoded_as>json</decoded_as>
    <field name="win.system.eventID">11</field>
    <field name="win.eventdata.image" type="pcre2">(?i)(theia|theia-backend|node)</field>
    <field name="win.eventdata.targetFilename" type="pcre2">(?i)(\.\.\/|~\/\.ssh\/|~\/\.bashrc|~\/\.zshrc|~\/\.profile|\/etc\/cron|\/etc\/rc\.)</field>
    <description>Eclipse Theia Agent Mode path traversal - file write outside workspace (CVE-2026-82217)</description>
    <mitre>
      <id>T1190</id>
      <id>T1565</id>
    </mitre>
    <group>path_traversal,theia,cve-2026-82217,</group>
    <options>no_full_log</options>
  </rule>

  <rule id="100228" level="12">
    <decoded_as>json</decoded_as>
    <field name="win.system.eventID">23</field>
    <field name="win.eventdata.image" type="pcre2">(?i)(theia|theia-backend|node)</field>
    <field name="win.eventdata.targetFilename" type="pcre2">(?i)(\.\.\/|~\/\.ssh\/|~\/\.bashrc|~\/\.zshrc|~\/\.profile|\/etc\/cron|\/etc\/rc\.)</field>
    <description>Eclipse Theia Agent Mode path traversal - file deletion outside workspace (CVE-2026-82217)</description>
    <mitre>
      <id>T1190</id>
      <id>T1565</id>
    </mitre>
    <group>path_traversal,theia,cve-2026-82217,</group>
    <options>no_full_log</options>
  </rule>

  <rule id="100229" level="10">
    <decoded_as>json</decoded_as>
    <field name="win.system.eventID">11</field>
    <field name="win.eventdata.image" type="pcre2">(?i)(theia|theia-backend|node)</field>
    <field name="win.eventdata.targetFilename" type="pcre2">(?i)(\/home\/[a-z0-9_]+\/\.|ssh\/authorized_keys|\/root\/\.bashrc|\/root\/\.ssh\/)</field>
    <description>Eclipse Theia Agent Mode - sensitive file access attempt (CVE-2026-82217)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>path_traversal,theia,cve-2026-82217,</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source at the time of this writing. The vendor has not released a fixed version, and affected versions remain vulnerable.

Immediate mitigations:

1. Disable Agent Mode: The most effective immediate mitigation is to disable Agent Mode in Eclipse Theia configurations until a patched version is available. This removes the attack surface entirely — the vulnerable writeFileContent, suggestFileContent, and helper functions remain dormant.
2. Restrict the Theia backend OS user: Run the Theia backend under a dedicated, least-privilege OS user account with restricted filesystem access. Ensure this user does not have write access to sensitive system areas (/etc, /root, other users' home directories).
3. Apply file-system level restrictions: Use OS-level path access controls (e.g., AppArmor, SELinux, or Unix file permissions) to prevent the Theia backend user from writing to shell startup files, SSH directories, and system configuration directories.
4. Disable confirmation-less writes: If Agent Mode cannot be disabled, review Theia settings for any option that enables confirmation dialogs for Agent Mode operations. In the absence of a specific setting, treat all AI-generated file operations as untrusted.
5. Monitor for anomalous file activity: Implement the detection rules above in your SIEM/SOC stack to identify suspicious path traversal attempts or writes to sensitive files.
6. Sandbox Theia: Deploy Theia in a container or VM with a minimal, non-persistent filesystem. Rebuild the environment from a known-good image periodically to remove any planted persistence.
7. Educate users: Advise developers to be cautious when opening code repositories, documentation, or packages from untrusted sources in Theia Agent Mode. Indirect prompt injection can trigger the vulnerability without explicit user action.

Patch/upgrade steps:

• Monitor the Eclipse Theia project's release notes and security advisories for a fixed version (likely 1.75.0 or later, given the affected range is up to but not including 1.75.0). Upgrade to the patched version as soon as it is available.
• Subscribe to the Eclipse Theia security mailing list and NVD notifications for CVE-2026-82217 updates.

Long-term hardening:

• Establish a policy that AI-assisted development tools must validate all file operations against a workspace confinement boundary before execution.
• Implement a zero-trust posture for AI-generated actions: require explicit user approval for any operation that writes outside the workspace or touches sensitive paths.
• Conduct periodic security reviews of AI/agent-based IDE features, treating model outputs as untrusted input.
• Consider network-level controls to restrict Theia backend access to trusted clients only, reducing the remote attack surface.
• Maintain a robust backup strategy so that destructive file deletions can be recovered.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-82217
2. Eclipse Theia Project: https://theia-ide.org/
3. Eclipse Theia GitHub Repository (for release notes and issue tracking): https://github.com/eclipse-theia/theia
4. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html

Known threat actor campaigns or exploit-in-the-wild evidence: None documented at this time. No public PoC or exploit code is available. This vulnerability is newly disclosed, and no exploitation in the wild has been reported. However, the indirect prompt injection vector makes silent exploitation plausible — attackers could embed malicious instructions in publicly hosted code or documentation without direct interaction with the victim's IDE. Security teams should treat this as an actively exploitable vulnerability class and apply mitigations immediately.