VULNERABILITY INTELLIGENCE

CVE-2026-14574

CVSS score6.5 MEDIUM

EPSS probability0.40%

CISA KEVNot currently listed

Published2026-08-05

Last modified2026-10-23

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Description

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values without rejecting prototype-related keys (`__proto__`, `constructor`, `prototype`). Because this function is invoked by `PreferenceServiceImpl.doResolve` for every preference resolution across scopes (default, user, workspace, folder), a crafted preference value in a workspace settings file (`.theia/settings.json` or `.vscode/settings.json`) can pollute `Object.prototype` when the user opens the workspace, potentially altering application logic across the Theia process.

Weakness classification

emo@eclipse.org: CWE-1321

Primary references

emo@eclipse.org — Broken Link
emo@eclipse.org — Vendor Advisory
emo@eclipse.org — Exploit, Mitigation, Vendor Advisory, Issue Tracking
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Mitigation, Vendor Advisory