Eclipse Theia AI Agent Mode file-write tools let a model-supplied path escape the workspace and hit remote code execution

Eclipse Theia·Eclipse Theia AI "Agent Mode" file-change tools (writeFileContent, suggestFileContent, and related replacement/state helpers)Fixed

Theia's AI Agent Mode file tools resolved a model-supplied 'path' argument with a raw path resolver that performed no workspace-containment check before writing or deleting the file, so a tool call like writeFileContent({path: "../.bashrc", content: <payload>}) wrote outside the workspace as the Theia backend OS user; researchers showed a live LLM (nemotron-3-super) could be steered into emitting exactly this call via an indirectly prompt-injected README, and the resulting write to ~/.bashrc, sourced by Theia's own integrated terminal, executed attacker code with root privileges in the test environment.

Blast radius

Full code execution as the Theia backend OS user, demonstrated end-to-end (write → shell sourcing → `id` returning uid=0/root) in the researcher's reproduction; persistence was shown to be trivial via ~/.ssh/authorized_keys, git hooks, or crontab, and in multi-tenant/shared-backend deployments the same primitive would expose other users' data and sessions on that backend. No public count of affected production installations was disclosed; CVSS 3.1 score 8.8 (High), rated critical for deployments where Agent Mode is on by default or the backend is shared.

Root cause

The five AI file-change tool handlers called an unguarded relative-path resolver (resolveRelativePath) and an unguarded write/delete sink directly, bypassing the hardened, containment-checking resolver (resolveToUri/ensureWithinWorkspace/ensureAccessible) that already existed elsewhere in the same codebase but was never wired into the write path, and Path.normalize() preserved a leading '..' instead of stripping it.

How it was caught

Not caught by Theia's own testing; found and responsibly disclosed by an external security researcher (reporter 'zenniskayy') on 2026-07-24 via Eclipse's vulnerability-reports process, who also demonstrated the chain against a real compiled build and a real self-hosted LLM to prove the path was reachable through ordinary prompt-injected content, not just a synthetic test.

What changed

Patched in Eclipse Theia 1.75.0 (fix commit 28da106c254); the researcher's recommended remediation — routing every AI write/delete tool through resolveToUri()+ensureWithinWorkspace()/ensureAccessible(), re-checking containment at the write sink itself, canonicalizing paths to close symlink escapes, and requiring explicit confirmation for any write resolving outside the workspace root — was published alongside the advisory.

Take-awayWhen an agent tool accepts a model-supplied file path, enforce workspace containment at the actual write/delete sink, not only in a resolver helper elsewhere in the codebase — and never assume the model will decline a malicious path, since researchers showed model behavior on the same prompt was inconsistent across models.