Eclipse Theia Agent Mode Path Traversal via Prompt Injection

Technical Analysis

The vulnerability lies in Theia's writeFileContent, suggestFileContent, and related state/replacement helper tools, which resolve a file path argument supplied by the LLM without enforcing workspace containment. An attacker delivers a prompt injection payload (e.g., via a poisoned file, README, web page, or other content the agent ingests) that steers the model into emitting a crafted path such as a relative traversal (../.bashrc), an absolute path, or a tilde-expanded home directory path. Because Agent Mode applies file writes autonomously without a confirmation dialog, the malicious tool call executes immediately with the privileges of the Theia backend OS user, crossing the boundary from 'model output' to 'filesystem write' with no human-in-the-loop check. The attacker gains arbitrary file write/delete capability outside the intended workspace, which can be escalated to remote code execution by targeting files like ~/.bashrc, ~/.ssh/authorized_keys, or other host-executed scripts.

Affected Systems

Eclipse Theia

Detection Signatures

• Tool call arguments to writeFileContent/suggestFileContent containing '../' sequences, absolute paths, or '~' expansion outside the expected workspace root.
• Backend file-write logs showing paths resolving outside the workspace directory boundary.
• Unexpected modifications to shell startup files (.bashrc, .profile, .zshrc) or ~/.ssh/authorized_keys correlating with Theia agent activity.
• Agent Mode tool invocations lacking a corresponding user confirmation event in audit logs.
• Indirect prompt injection indicators in ingested content (files, URLs, repo content) containing instructions referencing file paths or system directories.

Remediation Steps

1. 1

   Upgrade Eclipse Theia

   Update to Eclipse Theia 1.75.0 or later, which contains the fix for this path traversal vulnerability.

2. 2

   Enforce workspace containment

   Ensure all file-modifying tool paths are canonicalized and validated to remain strictly within the workspace root before any write or delete operation.

3. 3

   Require human confirmation for file writes

   Reintroduce or enforce a confirmation dialog for Agent Mode file changes, especially for paths outside the immediate working directory.

4. 4

   Sandbox the Theia backend

   Run the Theia backend process under a restricted OS user with minimal filesystem permissions to limit blast radius if traversal occurs.

5. 5

   Harden against indirect prompt injection

   Sanitize and isolate untrusted content (files, web pages, repos) ingested by the agent, and apply content provenance/tagging so the model treats external content as data, not instructions.