What happened
Theia's LLM-driven Agent Mode could be induced (via prompt injection or a malicious task) to write arbitrary files outside the user's workspace by supplying a relative path that traverses upward, effectively giving an AI coding agent uncontrolled filesystem write access on the developer's machine.
Why it matters
This is a textbook agent-execution attack class — a model-controlled file-write tool without a containment boundary — that could be triggered by indirect prompt injection from untrusted repo content, letting an attacker overwrite shell profiles, SSH keys, or other sensitive files on a developer workstation.
Attack vector
Theia's AI 'Agent Mode' file-change tools (writeFileContent, suggestFileContent, and replacement/state helpers) resolve a model-supplied file path without a workspace-containment check, so a crafted relative path such as ../.bashrc lets the AI agent write files outside the intended workspace directory.
Affected systems
Eclipse Theia versions 1.73.0 up to (not including) 1.75.0
Mitigation
Upgrade to Eclipse Theia 1.75.0 or later, which adds workspace-containment validation to Agent Mode file tools.