CVE-2024-0740 is a critical remote code execution flaw in Eclipse Target Management, Terminal and Remote System Explorer (RSE), scored 9.8. The record says versions up to 4.5.400 are affected and the fix is included in Eclipse IDE 2024-03. No authentication is needed to reach it.
What's affected
The NVD record says Eclipse Target Management: Terminal and Remote System Explorer version 4.5.400 or earlier has a remote code execution vulnerability that does not require authentication, and that the fixed version is included in Eclipse IDE 2024-03. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weaknesses are CWE-78 (OS command injection) and CWE-77 (command injection).
There is a source conflict on the range. The Eclipse security issue page titles the affected range as 4.5.500 or earlier in one place and 4.5.400 or earlier in the summary, so the upper bound needs confirming. The page lists no fixed version of its own. It names the class org.eclipse.dstore.core.server.ServerLauncher in the DataStore core jar as the affected component. The only fix statement I can rely on is the one in the NVD record, Eclipse IDE 2024-03, and the project's code review linked from the record.
How to check if you're exposed
Exposure depends on whether the RSE DataStore server is running and reachable, not just whether the plugin is installed. A developer workstation with RSE installed but no server listening is far less exposed than a host running the server on a network port.
To check the IDE version, open Help, About Eclipse IDE, and read the release name. Anything older than 2024-03 needs attention. On a host, list listening ports and look for the DataStore service with your usual tools, for example:
ss -ltnp
On Windows, use netstat -ano. The issue page mentions the server listening on port 8050 in the reporter's setup, though your configuration may differ.
What to do now
- Inventory Eclipse installs that include Remote System Explorer, including those baked into developer images and build servers.
- Upgrade to Eclipse IDE 2024-03 or later, and check the RSE version it contains.
- Do not run the DataStore server on a network reachable port unless you need it, and firewall it to trusted hosts if you do.
- Check build and lab machines for a running DataStore server process.
- Because the affected upper bound differs between sources, confirm the fixed build against the project's code review before closing the ticket.
Why it matters
OS command injection occurs when input that should be plain data is passed to a shell, so special characters let it become commands. The Eclipse issue ties the flaw to the server launcher handling input, and the score reflects what that means: no login, no user interaction, full impact.
Developer tooling is easy to forget in vulnerability programs. Eclipse installs sit on laptops and build hosts that often hold source code, signing material and cloud credentials. The record does not mark this CVE as known exploited, and neither Eclipse page I read says it has been.
If the affected component is something your own code pulls in as a dependency, the free in-browser dependency scan at gold.safeguard.sh/scan will tell you whether it appears in your manifests. Reachability analysis then helps you separate the copies that your code actually exercises from the ones that only sit in the tree.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is installing RSE enough to be at risk?
Not by itself. The issue concerns the DataStore server listening on a port, so check whether that server runs and who can reach it.
What is the fixed version?
The NVD record says the fix is included in Eclipse IDE 2024-03. The project's issue page lists no fixed version, so confirm with the Eclipse code review.
Sources
Last reviewed: 19 October 2026.
