Vulnerability Report

CVE-2026-1699

RCE

Title: RCE in Eclipse Theia Website GitHub Actions Workflow

RCE

Proof Of Concept

PoC Available for CVE-2026-1699

CWE Category CWE-829

Published Date Jan 30, 2026

Modified Date Mar 10, 2026

Exploit Status Available

Score 10.0 CVSS v3.1

Exploit Probability (EPSS)

0.51%

Vulnerability Summary

CVE-2026-1699: In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to repository secrets and a GITHUB_TOKEN with extensive write permissions (contents:write, packages:write, pages:write, actions:write). An attacker could exfiltrate secrets, publish malicious packages to the eclipse-theia organization, modify the official Theia website, and push malicious code to the repository.

Impacted Vendors

eclipse 1

Reference Links

https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/332

CVSS v3.1

Source Entity [email protected]

Severity CRITICAL

10.0

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS v3.1

Source Entity [email protected]

Severity HIGH

8.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-1699 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/pvharmo2/gha-lab-b5c1313658

View Code

March 10, 2026 MODIFIED

Vulnerability data updated via NVD.

March 10, 2026 MODIFIED

Vulnerability data updated via NVD.

February 04, 2026 MODIFIED

Vulnerability data updated via NVD.

January 30, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity LOW

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected Stack

No specific products linked.