CVE-2026-1699

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1699", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "state": "PUBLISHED", "assignerShortName": "eclipse", "dateReserved": "2026-01-30T09:38:43.466Z", "datePublished": "2026-01-30T09:57:14.877Z", "dateUpdated": "2026-02-02T19:26:31.652Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Eclipse Theia - Website", "repo": "https://github.com/eclipse-theia/theia-website", "vendor": "Eclipse Foundation", "versions": [{"lessThan": "2fb0cc4bfc372cfaef79feb4eebb6563778b2560", "status": "affected", "version": "0", "versionType": "git"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Barak Haryati | JFrog"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "In the Eclipse Theia Website repository, the GitHub Actions workflow <code>.github/workflows/preview.yml</code> used <code>pull_request_target</code> trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to repository secrets and a GITHUB_TOKEN with extensive write permissions (contents:write, packages:write, pages:write, actions:write). An attacker could exfiltrate secrets, publish malicious packages to the eclipse-theia organization, modify the official Theia website, and push malicious code to the repository."}], "value": "In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to repository secrets and a GITHUB_TOKEN with extensive write permissions (contents:write, packages:write, pages:write, actions:write). An attacker could exfiltrate secrets, publish malicious packages to the eclipse-theia organization, modify the official Theia website, and push malicious code to the repository."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-829", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-01-30T09:57:14.877Z"}, "references": [{"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/332"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-02T19:26:22.478406Z", "id": "CVE-2026-1699", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T19:26:31.652Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1699", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-02T19:26:22.478406Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T19:26:28.448Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Barak Haryati | JFrog"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/eclipse-theia/theia-website", "vendor": "Eclipse Foundation", "product": "Eclipse Theia - Website", "versions": [{"status": "affected", "version": "0", "lessThan": "2fb0cc4bfc372cfaef79feb4eebb6563778b2560", "versionType": "git"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/332"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to repository secrets and a GITHUB_TOKEN with extensive write permissions (contents:write, packages:write, pages:write, actions:write). An attacker could exfiltrate secrets, publish malicious packages to the eclipse-theia organization, modify the official Theia website, and push malicious code to the repository.", "supportingMedia": [{"type": "text/html", "value": "In the Eclipse Theia Website repository, the GitHub Actions workflow <code>.github/workflows/preview.yml</code> used <code>pull_request_target</code> trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to repository secrets and a GITHUB_TOKEN with extensive write permissions (contents:write, packages:write, pages:write, actions:write). An attacker could exfiltrate secrets, publish malicious packages to the eclipse-theia organization, modify the official Theia website, and push malicious code to the repository.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-829", "description": "CWE-829 Inclusion of Functionality from Untrusted Control Sphere"}]}], "providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-01-30T09:57:14.877Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1699", "state": "PUBLISHED", "dateUpdated": "2026-02-02T19:26:31.652Z", "dateReserved": "2026-01-30T09:38:43.466Z", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "datePublished": "2026-01-30T09:57:14.877Z", "assignerShortName": "eclipse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Eclipse Theia - Website", "repo": "https://github.com/eclipse-theia/theia-website", "vendor": "Eclipse Foundation", "versions": [{"lessThan": "2fb0cc4bfc372cfaef79feb4eebb6563778b2560", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "emo@eclipse.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:theia_website:*:*:*:*:*:*:*:*", "matchCriteriaId": "9712F17D-952F-44AE-931E-8C2491E4C1C7", "versionEndExcluding": "2026-01-22", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_target trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to repository secrets and a GITHUB_TOKEN with extensive write permissions (contents:write, packages:write, pages:write, actions:write). An attacker could exfiltrate secrets, publish malicious packages to the eclipse-theia organization, modify the official Theia website, and push malicious code to the repository."}, {"lang": "es", "value": "En el repositorio de Eclipse Theia Website, el flujo de trabajo de GitHub Actions .github/workflows/preview.yml utiliz\u00f3 el disparador pull_request_target mientras extra\u00eda y ejecutaba c\u00f3digo de solicitud de extracci\u00f3n no confiable. Esto permiti\u00f3 a cualquier usuario de GitHub ejecutar c\u00f3digo arbitrario en el entorno de CI del repositorio con acceso a secretos del repositorio y un GITHUB_TOKEN con amplios permisos de escritura (contents:write, packages:write, pages:write, actions:write). Un atacante podr\u00eda exfiltrar secretos, publicar paquetes maliciosos en la organizaci\u00f3n eclipse-theia, modificar el sitio web oficial de Theia y enviar c\u00f3digo malicioso al repositorio."}], "id": "CVE-2026-1699", "lastModified": "2026-06-17T10:16:21.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 6.0, "source": "emo@eclipse.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1699", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-02T19:26:22.478406Z", "version": "2.0.3"}}]}, "published": "2026-01-30T10:15:56.617", "references": [{"source": "emo@eclipse.org", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/332"}], "sourceIdentifier": "emo@eclipse.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-829"}], "source": "emo@eclipse.org", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:11:49.175442+00:00", "value": {"mitigation_remediation": ["Replace the pull_request_target trigger with pull_request in the GitHub Actions workflow to avoid executing untrusted code with elevated privileges.", "Restrict the GITHUB_TOKEN used by the workflow to have only action\u2011read permissions or use a token with minimal scopes, and avoid exposing secrets inside the workflow; remove or restrict any secrets that are not needed for the build.", "Apply any available vendor patch or update to the workflow file, and perform a review to ensure that no other workflows or parts of the repository expose secrets or allow code execution with elevated privileges."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution via CI with Repository Secrets"}, "threat_synthesis": {"affected_systems": "All instances of the Eclipse Theia Website that use the reported .github/workflows/preview.yml workflow are affected; no specific version of the website is listed, so all current deployments that include this workflow are considered vulnerable.", "description_and_impact": "The Eclipse Theia Website repository contains a GitHub Actions workflow that triggers on pull_request_target, allowing GitHub users to run untrusted pull\u2011request code during the workflow. This gives the code a GitHub token that has extensive write permissions, giving the attacker the ability to read and exfiltrate any secrets stored on the repository and to modify website content or publish malicious packages for the eclipse\u2011theia organization. The vulnerability is an example of Access Control: Improper Authorization of a Privileged Token (CWE\u2011829).", "risk_and_exploitability": "This flaw carries a CVSS base score of 10, indicating critical severity. The EPSS score is less than 1\u202f%, suggesting very low exploitation probability, and it is not currently catalogued as a known exploited vulnerability. The likely attack vector is any GitHub user who can submit a pull request to the repository, causing the workflow to execute with a high\u2011privilege GITHUB_TOKEN. If exploited, the attacker could obtain secrets, alter the website, or inject malicious code into the repository."}}}}, "created": "2026-02-02T09:27:55.665319+00:00", "title": "Unprotected GitHub Actions Allows Arbitrary Code Execution with Repository Secrets", "updated": "2026-04-18T01:15:05.993120+00:00", "vendors": ["eclipse", "eclipse$PRODUCT$theia"]}