{"action":"Upgrade @theia/ai-chat to 1.71.0 or later.","affected":[{"fixed":"1.71.0","introduced":"0"}],"component":"@theia/ai-chat","cve_ids":["CVE-2026-44688"],"ecosystem":"npm","epss":0.00507,"exploited":false,"fixed_versions":["1.71.0"],"ghsa_id":"GHSA-3jww-hxqj-wfq2","id":"tcs_01M5KEXMBTY8AK88Q31FGEPC18","modified_at":"2026-09-10T03:50:55.306656325Z","published_at":"2026-06-18T18:35:22Z","references":["https://osv.dev/vulnerability/GHSA-3jww-hxqj-wfq2","https://nvd.nist.gov/vuln/detail/CVE-2026-44688","https://github.com/eclipse-theia/theia/issues/16892","https://github.com/eclipse-theia/theia/pull/17364","https://github.com/eclipse-theia/theia/commit/e3fdfe6992389bc5fa611058d00c39d7408508ed","https://github.com/eclipse-theia/theia","https://gitlab.eclipse.org/security/cve-assignment/-/work_items/113"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-3jww-hxqj-wfq2#npm/@theia/ai-chat","url":"https://osv.dev/vulnerability/GHSA-3jww-hxqj-wfq2"}],"summary":"[Eclipse Theia] Indirect Prompt Injection via Adversarial Workspace File and Directory Names in AI Chat"}