Eclipse Theia IDE MCP Configuration Code Execution

Affected Vendor(s)

Affected Product(s)

Summary

The Eclipse Theia IDE automatically loads MCP configurations from the .theia\settings.json file upon opening a source code directory. This file can contain arbitrary code that will execute without any further user interaction.

Timeline

Discovered on
November 17, 2025
Disclosed to Vendor on
November 18, 2025
Published on
January 30, 2026

Credit

Blog Post

References

Learn how Mindgard can help you navigate AI Security

Take the first step towards securing your AI. Book a demo now and we'll reach out to you.