PT-2026-41585
CVE-2026-8765
·
Published
2026-05-17
·
Updated
2026-10-14
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Kilo-Org kilocode versions prior to 7.0.48
Description
A path traversal issue exists in the File Diff API Endpoint within the
Bun.file function of the packages/opencode/src/kilocode/review/worktree-diff.ts file. A remote attacker can trigger this by manipulating the File argument.Recommendations
Update to a version later than 7.0.47.
As a temporary workaround, restrict access to the
Bun.file function in the File Diff API Endpoint to minimize the risk of exploitation.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾