CVE-2026-8766

Name of the Vulnerable Software and Affected Versions Kilo-Org kilocode versions prior to 7.0.48

Description A flaw in the Environment Variable Handler component allows remote information disclosure. The issue exists within the Load() function located in the packages/opencode/src/config/config.ts file. An attacker can trigger this by manipulating the KILO CONFIG CONTENT argument.

Recommendations Update to a version newer than 7.0.47. As a temporary workaround, restrict or monitor the use of the KILO CONFIG CONTENT argument to minimize the risk of information disclosure.