PT-2026-5388 · Eclipse · Eclipse Theia - Website

Barak Haryati · Publicado 2026-01-30 · Atualizado 2026-01-30 · CVE-2026-1699

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Theia Website (affected versions not specified)

Description The GitHub Actions workflow located at .github/workflows/preview.yml in the Eclipse Theia Website repository utilized the pull request target trigger, which allowed for the execution of untrusted pull request code. This enabled any GitHub user to execute arbitrary code within the repository's CI environment, gaining access to repository secrets and a GITHUB TOKEN possessing extensive write permissions, including permissions for contents, packages, pages, and actions. An attacker could potentially exfiltrate sensitive information, publish malicious packages to the eclipse-theia organization, modify the official Theia website, and introduce malicious code into the repository.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-829

Identificadores relacionados

CVE-2026-1699

Produtos afetados

Eclipse Theia - Website

Referências · 9

• https://twitter.com/VulmonFeeds/status/2017185710386630882 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2017183396339081218 · Publicação no Twitter
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/332 · Aviso do Fabricante
• https://twitter.com/0dayPublishing/status/2017178840313782339 · Publicação no Twitter
• https://t.me/CVEtracker/43273 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-1699 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-1699 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2017184780060946810 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2017193905616281943 · Publicação no Twitter