Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-8766: Kilo-Org kilocode Environment Variable Handler info leak

CVE-2026-8766 · published 5 months ago

Summary

A security flaw in Kilo-Org kilocode versions up to 7.0.47 allows an attacker to access sensitive information. This is a concern because it could happen remotely and an exploit is already available. To protect your system, update to a fixed version of kilocode as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	kilo	kilo_code	>= 7.0.0, <= 7.0.47 `cpe:2.3:a:kilo:kilo_code::::::visual_studio_code::*`
npm	kilocode	cli	<= 7.0.47
npm	kilocode	@kilocode/cli	<= 7.0.47
–	kilo	kilo_code_cli	<= 7.0.47 `cpe:2.3:a:kilo:kilo_code_cli::::::node.js::*`

Original advisory text

@kilocode/cli Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

A flaw has been found in Kilo-Org kilocode up to 7.0.47. This issue affects the function Load of the file packages/opencode/src/config/config.ts of the component Environment Variable Handler. Executing a manipulation of the argument KILO_CONFIG_CONTENT can lead to information disclosure. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

https://gist.github.com/YLChen-007/32b444e49ced1a46bde5a68933ccd09f Exploit Third Party Advisory
https://vuldb.com/submit/811400 Exploit Third Party Advisory VDB Entry
https://vuldb.com/vuln/364391 Third Party Advisory VDB Entry
https://vuldb.com/vuln/364391/cti Permissions Required VDB Entry
https://nvd.nist.gov/vuln/detail/CVE-2026-8766
https://github.com/advisories/GHSA-rpc6-9c4p-j5cg
https://github.com/Kilo-Org/kilocode Product

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.1 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-200Information Exposure

CWE-284Improper Access Control

Timeline

Published17 May 2026

Updated31 Oct 2026

First seen17 May 2026

Sources

CVE-2026-8766 · NVD

GHSA-rpc6-9c4p-j5cg · GHSA

GHSA-rpc6-9c4p-j5cg · OSV

Track software like this

Free during beta