@kilocode/cli (>=7.2.3, <=7.4.0) potentially affected by CVE-2026-79403 via @kilocode/cli-darwin-x64-baseline (>=7.2.3, <=7.4.0)

@kilocode/cli-darwin-x64-baseline NPM version =7.2.3, =7.2.3, =7.4.0 Source cves: CVE-2026-79403 Source advisory: MEND:CVE-2026-79403...

@kilocode/cli (>=7.2.3, <=7.4.0) potentially affected by CVE-2026-79403 via @kilocode/cli-linux-x64 (>=7.2.3, <=7.4.0)

@kilocode/cli-linux-x64 NPM version =7.2.3, =7.2.3, =7.4.0 Source cves: CVE-2026-79403 Source advisory: MEND:CVE-2026-79403...

@kilocode/cli (>=7.2.3, <=7.4.0) potentially affected by CVE-2026-79403 via @kilocode/cli-linux-x64-baseline (>=7.2.3, <=7.4.0)

@kilocode/cli-linux-x64-baseline NPM version =7.2.3, =7.2.3, =7.4.0 Source cves: CVE-2026-79403 Source advisory: MEND:CVE-2026-79403...

@kilocode/cli (>=7.2.3, <=7.4.0) potentially affected by CVE-2026-79403 via @kilocode/cli-linux-x64-baseline-musl (>=7.2.3, <=7.4.0)

@kilocode/cli-linux-x64-baseline-musl NPM version =7.2.3, =7.2.3, =7.4.0 Source cves: CVE-2026-79403 Source advisory: MEND:CVE-2026-79403...

@kilocode/cli (>=7.2.3, <=7.4.0) potentially affected by CVE-2026-79403 via @kilocode/cli-darwin-x64 (>=7.2.3, <=7.4.0)

@kilocode/cli-darwin-x64 NPM version =7.2.3, =7.2.3, =7.4.0 Source cves: CVE-2026-79403 Source advisory: MEND:CVE-2026-79403...

@kilocode/cli (>=7.2.3, <=7.4.0) potentially affected by CVE-2026-79403 via @kilocode/cli-linux-arm64 (>=7.2.3, <=7.4.0)

@kilocode/cli-linux-arm64 NPM version =7.2.3, =7.2.3, =7.4.0 Source cves: CVE-2026-79403 Source advisory: MEND:CVE-2026-79403...

@kilocode/cli (>=7.2.3, <=7.4.0) potentially affected by CVE-2026-79403 via @kilocode/cli-linux-x64-musl (>=7.2.3, <=7.4.0)

@kilocode/cli-linux-x64-musl NPM version =7.2.3, =7.2.3, =7.4.0 Source cves: CVE-2026-79403 Source advisory: MEND:CVE-2026-79403...

@kilocode/cli (>=7.2.3, <=7.4.0) potentially affected by CVE-2026-79403 via @kilocode/cli-windows-x64 (>=7.2.3, <=7.4.0)

@kilocode/cli-windows-x64 NPM version =7.2.3, =7.2.3, =7.4.0 Source cves: CVE-2026-79403 Source advisory: MEND:CVE-2026-79403...

@kilocode/cli (>=7.2.3, <=7.4.0) potentially affected by CVE-2026-79403 via @kilocode/cli-windows-x64-baseline (>=7.2.3, <=7.4.0)

@kilocode/cli-windows-x64-baseline NPM version =7.2.3, =7.2.3, =7.4.0 Source cves: CVE-2026-79403 Source advisory: MEND:CVE-2026-79403...

@kilocode/cli (>=7.2.3, <=7.4.0) potentially affected by CVE-2026-79403 via @kilocode/cli-linux-arm64-musl (>=7.2.3, <=7.4.0)

@kilocode/cli-linux-arm64-musl NPM version =7.2.3, =7.2.3, =7.4.0 Source cves: CVE-2026-79403 Source advisory: MEND:CVE-2026-79403...

@kilocode/cli (>=7.2.3, <=7.4.0) potentially affected by CVE-2026-79403 via @kilocode/cli-windows-arm64 (>=7.2.3, <=7.4.0)

@kilocode/cli-windows-arm64 NPM version =7.2.3, =7.2.3, =7.4.0 Source cves: CVE-2026-79403 Source advisory: MEND:CVE-2026-79403...

@kilocode/cli (>=7.2.3, <=7.4.0) potentially affected by CVE-2026-79403 via @kilocode/cli-darwin-arm64 (>=7.2.3, <=7.4.0)

@kilocode/cli-darwin-arm64 NPM version =7.2.3, =7.2.3, =7.4.0 Source cves: CVE-2026-79403 Source advisory: MEND:CVE-2026-79403...

CVE-2026-8766

A flaw has been found in Kilo-Org kilocode up to 7.0.47. This issue affects the function Load of the file packages/opencode/src/config/config.ts of the component Environment Variable Handler. Executing a manipulation of the argument KILOCONFIGCONTENT can lead to information disclosure. It is...

CVE-2026-8765

A vulnerability was detected in Kilo-Org kilocode up to 7.0.47. This vulnerability affects the function Bun.file of the file packages/opencode/src/kilocode/review/worktree-diff.ts of the component File Diff API Endpoint. Performing a manipulation of the argument File results in path traversal. It...

GHSA-RPC6-9C4P-J5CG @kilocode/cli Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

A flaw has been found in Kilo-Org kilocode up to 7.0.47. This issue affects the function Load of the file packages/opencode/src/config/config.ts of the component Environment Variable Handler. Executing a manipulation of the argument KILOCONFIGCONTENT can lead to information disclosure. It is...

EUVD-2026-30710

A flaw has been found in Kilo-Org kilocode up to 7.0.47. This issue affects the function Load of the file packages/opencode/src/config/config.ts of the component Environment Variable Handler. Executing a manipulation of the argument KILOCONFIGCONTENT can lead to information disclosure. It is...

EUVD-2026-30709

A vulnerability was detected in Kilo-Org kilocode up to 7.0.47. This vulnerability affects the function Bun.file of the file packages/opencode/src/kilocode/review/worktree-diff.ts of the component File Diff API Endpoint. Performing a manipulation of the argument File results in path traversal. It...

@kilocode/cli Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

A flaw has been found in Kilo-Org kilocode up to 7.0.47. This issue affects the function Load of the file packages/opencode/src/config/config.ts of the component Environment Variable Handler. Executing a manipulation of the argument KILOCONFIGCONTENT can lead to information disclosure. It is...

@kilocode/plugin (>=7.0.27, <=7.0.46) potentially affected by CVE-2026-8765 via @kilocode/sdk (>=7.0.27, <=7.0.46)

@kilocode/sdk NPM version =7.0.27, =7.0.27, =7.0.46 Source cves: CVE-2026-8765 Source advisory: SNYK:JS-KILOCODESDK-17878140...

Files or Directories Accessible to External Parties

Overview @kilocode/cli is a The AI coding agent built for the terminal. Generate code from natural language, automate tasks, and run terminal commands -- powered by 500+ AI models. Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the Load...