PatchTheCVEtheia vulnerabilities and fixes
Recent CVEs affecting theia, with upgrade or downgrade steps. 4 tracked.
theia has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2026-08-05. Highest priority: CVE-2026-12609 (score 50/100).
- CVE-2026-12609 HIGH 7.5 UPGRADE In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/
- CVE-2026-60009 HIGH 8.8 UPGRADE In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload
- CVE-2026-61891 HIGH 7.5 UPGRADE In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-downlo
- CVE-2026-14574 MEDIUM 6.5 UPGRADE In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia
FAQ
How do I fix theia vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is theia being exploited right now?
None of the tracked theia CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which theia CVE should I patch first?
CVE-2026-12609 currently ranks highest (50/100): In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/.