CVE-2026-1699

The workflow .github/workflows/preview.yml used the pull_request_target trigger, which — unlike pull_request — runs in the context of the target repository (with access to secrets) while simultaneously fetching and executing code from an external pull request. An attacker could open a malicious pull request whose code was then executed in a privileged CI environment with access to repository secrets and a GITHUB_TOKEN with contents:write, packages:write, pages:write, and actions:write permissions. This is a classic 'pwn request' exploitation technique, classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere).

An attacker could steal repository secrets, publish malicious packages to the eclipse-theia organization, modify the official Theia project website, and inject malicious code directly into the repository. The compromise could have affected the software supply chain distributed by the Eclipse organization.

Patches provided by the vendor should be applied according to references. Recommended actions include changing the trigger from pull_request_target to pull_request or adding explicit code verification before execution, restricting GITHUB_TOKEN permissions to the minimum necessary (principle of least privilege), and reviewing all workflows for similar configurations.

Eclipse Theia Website repository — workflow .github/workflows/preview.yml; CI/CD environment based on GitHub Actions with vulnerable pull_request_target trigger configuration