Alertas de Seguridad de la Información

M Alto vulnerabilidad

05/08/2026

Vulnerabilidad alta en Eclipse Theia 1.73.1 expone acceso no autorizado a archivos del servidor

Eclipse Theia versiones hasta 1.73.1 contienen una vulnerabilidad que permite a atacantes descargar archivos arbitrarios del servidor sin restricción de directorio workspace. El backend `@theia/filesystem` no valida correctamente las rutas URI en endpoints HTTP, afectando especialmente despliegues en navegador donde la validación de tokens es insuficiente. Empresas LATAM usando Theia como IDE en la nube corren riesgo de exposición de fuentes, configuraciones sensibles y datos de negocio.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-46581] In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not prope…

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-60009] In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /f…

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart `uri` field and calls `fs.move(tmp, target, { overwrite: true })` with no workspace confinement and no authentication. In browser (non-Electron) deployments the connection toke…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

05/08/2026

[CVE-2026-12609] In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend expo…

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with `path.resolve(localPath, filePath)` without verifying that the resolved path stays within the plugin's directory. An unauthenticated network attacker can send percent-encoded `../` sequences (`%2e%2…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-47858] Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes t…

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

30/07/2026

[CVE-2026-47873] The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of th…

The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricting them to loopback. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

nvdaltovulnerabilidad CVSS 8.0 NVD

E Alto vulnerabilidad

14/07/2026

[CVE-2026-15075] In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRe…

In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison (scheme, host, port) is performed before copying headers to the redirect target. As a result, credential headers, including Authorization, Coo…

nvdaltovulnerabilidad CVSS 7.5 NVD

E Alto vulnerabilidad

14/07/2026

[CVE-2026-15076] In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession com…

In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches the originating server's domain, in violation of RFC 6265 section 5.3. An attacker who controls any server that the victim application contacts can inject a cookie scoped to an arb…

nvdaltovulnerabilidad CVSS 7.5 NVD

E Alto vulnerabilidad

14/07/2026

[CVE-2024-7708] For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer…

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

nvdaltovulnerabilidad CVSS 7.5 NVD

E Alto vulnerabilidad

14/07/2026

[CVE-2026-10051] In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in…

In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the union of trailers of the first request and the current request.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-10055] In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker…

In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller. Because the destination URL is neither validated nor allowlisted, a remote attacker with access to the Theia service co…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-10054] In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged term…

In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket (/services/shell-terminal, /services/terminals/:id) without service-level authentication. WebSocket origin validation in @theia/core is fail-open: connections are accepted when the Origin header is missing or when no THEIA_HOSTS allowlist is configured (the default). The …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-58465] Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocation vulnerability in …

Eclipse Wakaama before snapshot/2026-05-26 contains an unbounded memory allocation vulnerability in the CoAP Block1 handler within coap/block.c that allows unauthenticated remote attackers to exhaust server memory by sending a sequence of Block1 PUT requests with incrementing block numbers. Attackers can target the registration endpoint over UDP without authentication, causing the server to repeat…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-14336] PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' …

PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as https://ci.eclipse.org@evil.host (userinfo trick) or https://ci.eclipse.org.evil.host (suffix trick) that satisfies the prefix…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

02/07/2026

[CVE-2026-9563] In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not e…

In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, o…

nvdaltovulnerabilidad CVSS 7.5 NVD

E Alto vulnerabilidad

19/06/2026

[CVE-2026-11576] The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP …

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to ope…

nvdaltovulnerabilidad CVSS 7.5 NVD

E Alto vulnerabilidad

18/06/2026

[CVE-2026-44691] In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/t…

In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files (e.g. .theia/tasks.json, .vscode/tasks.json) could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user's privileges. In combination with AI chat features and a workspace .theia/s…

nvdaltovulnerabilidad CVSS 8.8 NVD

E Alto vulnerabilidad

18/06/2026

[CVE-2026-46580] In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a…

In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded and could override or extend the AI agent's system prompts. An attacker could craft a malicious repository containing prompt template files that, when the workspace was opened in Theia, replaced the AI's system instructions with attacker-controlled content (indir…

nvdaltovulnerabilidad CVSS 8.8 NVD

E Alto vulnerabilidad

18/06/2026

[CVE-2026-44688] In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory …

In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository with adversarial directory or file names that, when analyzed by the AI agent, would cause the agent to follow attacker-controlled instructions (indirect prompt inj…

nvdaltovulnerabilidad CVSS 8.8 NVD