What happened
NVD published CVE-2026-19884 (CVSS 8.4, High) on 2026-08-14, describing a workspace-trust bypass in Eclipse Theia's git integration that starts source control operations on folder open, before any trust decision is made by the user.
Why it matters
Theia underlies several AI-assisted coding IDEs; a workspace-trust bypass at folder-open time is directly relevant to the growing class of attacks where a malicious repository exploits an AI coding agent's trust model to achieve unintended code execution before the user has vetted the folder.
Attack vector
Opening a folder starts source control integration without requiring the user to trust the folder first, allowing repository-embedded configuration or hooks to execute git operations before the workspace-trust boundary is established
Affected systems
Eclipse Theia ≤ 1.69.0 (@theia/git extension and Theia IDE)
Mitigation
Upgrade Eclipse Theia beyond 1.69.0; disable git integration for untrusted folders until patched