CVE-2026-82217 covers Eclipse Theia versions 1.73.0 to below 1.75.0. In AI "Agent Mode", the file-editing tools — writeFileContent, suggestFileContent and the associated replace and state helpers — resolved a path supplied by the model without verifying it belonged to the workspace. A relative ../.bashrc, an absolute path or a ~ expansion wrote or deleted files outside the workspace with the backend user's operating-system privileges. In Agent Mode those edits apply without a confirmation dialog. Writing to ~/.ssh/authorized_keys or a shell startup file escalates that to code execution on the backend. CVSS 3.1 is 8.8, assigned by NVD rather than self-scored.
The fix nobody could see
The advisory references a single commit. That commit belongs to a pull request titled "ai-ide: add Memory prompt capability". It does touch the vulnerable files — file-changeset-functions.ts and workspace-functions.ts — but by title and description it is a feature. An administrator reading the 1.75.0 release notes received no indication that upgrading closed a path-traversal-to-RCE chain.
The two gaps
Report to Eclipse: 24 July. Fix commit: 11 August. Release containing it: 27 August. Advisory: 31 August. Vulnerable 1.73 and 1.74 stayed deployed for roughly two months after the report, and the fix sat publicly in an open repository for 20 days before disclosure — readable by anyone who diffs commits, invisible to anyone who reads advisories.
What the shorthand misses
"Theia patched a vulnerability" implies a missing check was added. Eclipse's own report describes an incomplete fix: guards named ensureWithinWorkspace and resolveToUri already existed in the resolver layer, and the highest-impact tools bypassed them. The protection was present and not applied where it mattered most — a different failure mode, and a harder one to catch by review.
Why this generalises
This is not a theoretical prompt injection. It is a complete chain: external content, model output, file path, write outside the workspace, code on the host — with no user confirmation, because auto-apply is the design. Any IDE agent that combines a model-supplied path with automatic application has the same shape.