Approved changes feed: RSS · Atom

cpe:2.3:a:eclipse_foundation:eclipse_theia_-_website:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorEclipse Foundation (2c315c48-0111-5572-bbde-cc70cfafb2e9)
ProductEclipse Theia Website (b89b71c0-23e5-5caf-afc3-2616b8488c68)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-1699 vulnerable 2026-06-03 15:14:45.141087 Details available
CRITICAL (10)
In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to repository secrets and a GITHUB_TOKEN with extensive write permissions (contents:write, packages:write, pages:write, actions:write). An attacker could exfiltrate secrets, publish malicious packages to the eclipse-theia organization, modify the official Theia website, and push malicious code to the repository.
Published: 2026-01-30T09:57:14.877Z
Updated: 2026-02-02T19:26:31.652Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.