Kilo Code 信息泄露漏洞

Kilo Code is an open-source AI coding assistant developed by Kilo Code. Versions of Kilo Code 7.0.47 and earlier contained a vulnerability known as information leakage. This vulnerability stemmed from improper handling of the parameter KILOCONFIGCONTENT in the Load function of the Environment...

CVE-2026-30302

The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective. The vulnerability stems from the incorrect use of an incompatible command parser the Unix-based shell-quote library to analyze commands on the...

CVE-2026-30302

The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective. The vulnerability stems from the incorrect use of an incompatible command parser the Unix-based shell-quote library to analyze commands on the...

CVE-2026-30302

The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective. The vulnerability stems from the incorrect use of an incompatible command parser the Unix-based shell-quote library to analyze commands on the...

CVE-2026-30302

The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective. The vulnerability stems from the incorrect use of an incompatible command parser the Unix-based shell-quote library to analyze commands on the...

CVE-2026-30302: Improper Neutralization of Special Elements used in an OS Command

The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective. The vulnerability stems from the incorrect use of an incompatible command parser the Unix-based shell-quote library to analyze commands on the...

PT-2026-28395

Name of the Vulnerable Software and Affected Versions CodeRider-Kilo affected versions not specified Description A flaw exists in the command auto-approval module of CodeRider-Kilo that bypasses its whitelist security mechanism, leading to a potential OS Command Injection. This is due to the use ...

GitLab CodeRider-Kilo 安全漏洞

GitLab CodeRider-Kilo is an artificial intelligence programming assistant provided by GitLab Inc. There is a security vulnerability in GitLab CodeRider-Kilo. This vulnerability stems from the command autapproval module using an incompatible command parser on the Windows platform and failing to...

CVE-2026-30302

The CodeRider-Kilo command auto-approval module is vulnerable to OS Command Injection , which can lead to Remote Code Execution (RCE) . The root cause is the use of an incompatible Unix-based shell-quote library to analyze commands on the Windows platform, combined with a failure to correctly han...

CVE-2019-16096

Kilo 0.0.1 has a heap-based buffer overflow because there is an integer overflow in a calculation involving the number of tabs in one row...

CVE-2023-53806

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: populate subvp cmd info only for the top pipe Why System restart observed while changing the display resolution to 8k with extended mode. Sytem restart was caused by a page fault. How When the driver populates...

Malicious code in ksai-kiloa-aio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0581076b83ecfb9aa1c98da7100111e994f947105665b5ea2c03561f955c1f54 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ksai-kiloa-ailo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 653ba8de01c8055a71a6133f43a89f0038c26b4bf8b5a17c47a71824dc3c317d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-175636 Malicious code in ksai-kiloa-aio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0581076b83ecfb9aa1c98da7100111e994f947105665b5ea2c03561f955c1f54 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @miptaa02/kilo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfd5d86fe8c5c60ddfda8ad18b8381f780b9e889d5d05eca0ec63cdf17ac6e42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder 安全漏洞

KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder is a professional encoding device from KiloView UK. A security vulnerability exists in KiloView Dual Channel 4k HDMI & 3G-SDI HEVC Video Encoder version 1.20.0006, which stems from a problem with the systemctrl API System/reFactory compone...

CVE-2025-11445

A vulnerability was detected in Kilo Code up to 4.86.0. Affected is the function ClineProvider of the file src/core/webview/ClineProvider.ts of the component Prompt Handler. Performing manipulation results in injection. The attack can be initiated remotely. The exploit is now public and may be...

CVE-2025-11445

A vulnerability was detected in Kilo Code up to 4.86.0. Affected is the function ClineProvider of the file src/core/webview/ClineProvider.ts of the component Prompt Handler. Performing manipulation results in injection. The attack can be initiated remotely. The exploit is now public and may be...

CVE-2025-11445

A vulnerability was detected in Kilo Code up to 4.86.0. Affected is the function ClineProvider of the file src/core/webview/ClineProvider.ts of the component Prompt Handler. Performing manipulation results in injection. The attack can be initiated remotely. The exploit is now public and may be...

CVE-2025-11445

Kilo Code up to 4.86.0 is affected by an injection vulnerability in the ClineProvider function of src/core/webview/ClineProvider.ts within the Prompt Handler component. The issue allows remote manipulation and has publicly disclosed exploits; remediation is to apply the patch. The available docum...