Homepage

@theia/ai-chat@1.71.0-next.11

Theia - AI Chat Extension

  • latest version

    1.76.0

  • latest non vulnerable version

    1.77.0-next.89

  • first published

    2 years ago

  • latest version published

    1 months ago

  • licenses detected

  • View ai-chat package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @theia/ai-chat package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Insertion of Sensitive Information Into Sent Data

    @theia/ai-chat is a Theia - AI Chat Extension

    Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the rendering of Markdown image tags in AI chat responses. An attacker can cause sensitive information from the workspace or conversation context to be transmitted to external servers by inducing the AI agent to generate image URLs that encode this data.

    How to fix Insertion of Sensitive Information Into Sent Data?

    Upgrade @theia/ai-chat to version 1.71.0 or higher.

    <1.71.0
    • H
    Unsafe Dependency Resolution

    @theia/ai-chat is a Theia - AI Chat Extension

    Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the processing of workspace file and directory names in the AI chat. An attacker can cause the agent to execute attacker-controlled instructions by introducing specially crafted file or directory names in a repository, potentially leading to data exfiltration through Markdown image rendering or arbitrary command execution via task definitions.

    How to fix Unsafe Dependency Resolution?

    Upgrade @theia/ai-chat to version 1.71.0 or higher.

    <1.71.0
    • H
    Unsafe Dependency Resolution

    @theia/ai-chat is a Theia - AI Chat Extension

    Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the automatic loading of .prompts/*.prompttemplate files in a workspace. An attacker can manipulate the AI agent's system instructions by introducing crafted prompt template files, potentially leading to data exfiltration through Markdown image rendering or arbitrary command execution via task definitions when a malicious workspace is opened.

    How to fix Unsafe Dependency Resolution?

    Upgrade @theia/ai-chat to version 1.71.0 or higher.

    <1.71.0
    Go back to all versions of this package