Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was detected in Kilo-Org kilocode up to 7.0.47. This vulnerability affects the function Bun.file of the file packages/opencode/src/kilocode/review/worktree-diff.ts of the component File Diff API Endpoint. Performing a manipulation of the argument File results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-8765 A vulnerability was detected in Kilo-Org kilocode up to 7.0.47. This vulnerability affects the function Bun.file of the file packages/opencode/src/kilocode/review/workt… https://www.cve.org/CVERecord?id=CVE-2026-8765
Post summary
CVE-2026-8765 has been identified as a vulnerability in Kilo-Org kilocode up to 7.0.47, impacting the Bun.file function; no PoC, exploit, or patch details are provided.
CVE-2026-8765 Path Traversal in Kilo-Org Kilocode Up to 7.0.47 File Diff API End... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-8765 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The tweet announces CVE-2026-8765, a path traversal flaw in Kilo-Org Kilocode up to v7.0.47, and provides a link to additional details, but does not mention PoC, exploitation, patches, or active attacks.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | kilo | kilo_code | - | visual_studio_code | - |