PT-2026-5388 · Eclipse · Eclipse Theia - Website

Barak Haryati · Published 2026-01-30 · Updated 2026-01-30 · CVE-2026-1699

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Theia Website (affected versions not specified)

Description The GitHub Actions workflow located at .github/workflows/preview.yml in the Eclipse Theia Website repository utilized the pull request target trigger, which allowed for the execution of untrusted pull request code. This enabled any GitHub user to execute arbitrary code within the repository's CI environment, gaining access to repository secrets and a GITHUB TOKEN possessing extensive write permissions, including permissions for contents, packages, pages, and actions. An attacker could potentially exfiltrate sensitive information, publish malicious packages to the eclipse-theia organization, modify the official Theia website, and introduce malicious code into the repository.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2026-1699

Affected Products

Eclipse Theia - Website

References · 9

• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/332 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1699 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1699 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2017185710386630882 · Twitter Post
• https://twitter.com/CVEnew/status/2017183396339081218 · Twitter Post
• https://twitter.com/0dayPublishing/status/2017178840313782339 · Twitter Post
• https://t.me/CVEtracker/43273 · Telegram Post
• https://twitter.com/TheHackerWire/status/2017184780060946810 · Twitter Post
• https://twitter.com/CveFindCom/status/2017193905616281943 · Twitter Post