CVE-2026-14574
Published:August 05, 2026
Updated:September 01, 2026
In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the "PreferenceUtils.merge" function in "@theia/core" recursively merges preference values without rejecting prototype-related keys ("__proto__", "constructor", "prototype"). Because this function is invoked by "PreferenceServiceImpl.doResolve" for every preference resolution across scopes (default, user, workspace, folder), a crafted preference value in a workspace settings file (".theia/settings.json" or ".vscode/settings.json") can pollute "Object.prototype" when the user opens the workspace, potentially altering application logic across the Theia process.
Affected Packages
https://github.com/eclipse-theia/theia.git (GITHUB):
Affected version(s) >=v0.7.0 <v1.74.0Fix Suggestion:
Update to version v1.74.0@theia/core (NPM):
Affected version(s) >=0.7.0 <1.74.0Fix Suggestion:
Update to version 1.74.0Related Resources (6)
Do you need more information?
Contact UsCVSS v4
Base Score:
5.7
Attack Vector
LOCAL
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
ACTIVE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
HIGH
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
LOW
Subsequent System Availability
LOW
CVSS v3
Base Score:
7.7
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
HIGH
Availability
LOW
Weakness Type (CWE)
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
EPSS
Base Score:
0.30