Eclipse Che vulnerabilities

2 known vulnerabilities in Eclipse Che from Eclipse Foundation. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Eclipse Che: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-114278Oct 28, 2026Eclipse Foundation

  The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without any escaping

• 8.4 High severity

  Eclipse Che: External Control of File Name or Path

  CVE-2026-86671Oct 5, 2026Eclipse Foundation

  In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which calls `new URL(url).openConnection()` with no scheme or host allow-list and returns t