Theia Website
Approved changes feed: RSS · Atom
cpe:2.3:a:eclipse:theia_website:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Eclipse (fa988180-604e-5c1f-93ea-65b5297000fc) |
|---|---|
| Product | Theia Website (1e89b97a-cc94-5fae-9c95-f073c6d08c18) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/eclipse-theia/theia-website |
purl2cpe | 2026-06-01 10:15:03.296705 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-1699 |
vulnerable | 2026-06-08 07:49:09.393367 |
Details available
CRITICAL (10)
In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to repository secrets and a GITHUB_TOKEN with extensive write permissions (contents:write, packages:write, pages:write, actions:write). An attacker could exfiltrate secrets, publish malicious packages to the eclipse-theia organization, modify the official Theia website, and push malicious code to the repository.
Published: 2026-01-30T09:57:14.877Z
Updated: 2026-02-02T19:26:31.652Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.