Eclipse Theia’s agent mode wrote wherever the model pointed it

What happened

Theia’s AI agent-mode tools resolved model-supplied file paths without checking they stayed inside the workspace, so a relative path such as ../.bashrc, an absolute path, or a tilde-expanded path could write or delete files anywhere the Theia backend user could reach.

The path argument comes from model output, so anything that can influence the model can choose the target, which makes this reachable by indirect prompt injection rather than only by a hostile user. A shell profile is the obvious destination because it runs next time a terminal opens. CVSS 3.1 scores it 8.8 high, fixed in 1.75.0.