@kilocode/plugin (>=7.0.27, <=7.0.46) potentially affected by CVE-2026-8765 via @kilocode/sdk (>=7.0.27, <=7.0.46)

@kilocode/sdk NPM version =7.0.27, =7.0.27, =7.0.46 Source cves: CVE-2026-8765 Source advisory: SNYK:JS-KILOCODESDK-17878140...

CVE-2026-8765 Kilo-Org kilocode File Diff API Endpoint worktree-diff.ts Bun.file path traversal

A vulnerability was detected in Kilo-Org kilocode up to 7.0.47. This vulnerability affects the function Bun.file of the file packages/opencode/src/kilocode/review/worktree-diff.ts of the component File Diff API Endpoint. Performing a manipulation of the argument File results in path traversal. It...