CVE-2026-8765— Kilo-Org kilocode File Diff API Endpoint worktree-diff.ts Bun.file path traversal

CVSS 4.3 · Medium EPSS 0.04% · P12 Updated May 18, 2026

Possible ATT&CK Techniques 1AI

Affected Version Matrix 48

Vendor	Product	Version Range	Status
Kilo-Org	kilocode	`7.0.0`	affected
		`7.0.1`	affected
		`7.0.2`	affected
		`7.0.3`	affected
		`7.0.4`	affected
		`7.0.5`	affected
		`7.0.6`	affected
		`7.0.7`	affected
… +40 more rows

Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-8765

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Kilo-Org kilocode File Diff API Endpoint worktree-diff.ts Bun.file path traversal

Source: NVD (National Vulnerability Database)

Vulnerability Description

A vulnerability was detected in Kilo-Org kilocode up to 7.0.47. This vulnerability affects the function Bun.file of the file packages/opencode/src/kilocode/review/worktree-diff.ts of the component File Diff API Endpoint. Performing a manipulation of the argument File results in path traversal. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Source: NVD (National Vulnerability Database)

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: NVD (National Vulnerability Database)

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: NVD (National Vulnerability Database)

Vulnerability Title

Kilo Code 路径遍历漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Kilo Code是Kilo Code开源的一个AI编码助手。 Kilo Code 7.0.47及之前版本存在路径遍历漏洞，该漏洞源于File Diff API Endpoint组件中worktree-diff.ts文件的Bun.file函数对参数File处理不当，导致路径遍历。攻击者可能远程利用此漏洞。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Kilo-Org	kilocode	7.0.0	`cpe:2.3:a:kilo-org:kilocode::::::::`

II. Public POCs for CVE-2026-8765

#	POC Description	Source Link	Shenlong Link

AI-Generated POCPremium

No public POC found.

III. Intelligence Information for CVE-2026-8765

请登录查看更多情报信息。

Other · 1

https://gist.github.com/YLChen-007/1770f4530b0c933dc61f15b02aa0629dexploit
https://vuldb.com/vuln/364390/ctisignaturepermissions-required
https://vuldb.com/submit/811401third-party-advisory
CVE-2026-8765 | Kilo-Org kilocode up to 7.0.47 File Diff API Endpoint worktree-diff.ts Bun.file path traversalvdb-entrytechnical-description
https://nvd.nist.gov/vuln/detail/CVE-2026-8765

IV. Related Vulnerabilities

Same product: kilocode

CVE-2026-8766
Kilo-Org kilocode Environment Variable config.ts load inform

Same vendor: Kilo-Org

CVE-2026-8766
Kilo-Org kilocode Environment Variable config.ts load inform

Same weakness: CWE-22

V. Comments for CVE-2026-8765

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-8765— Kilo-Org kilocode File Diff API Endpoint worktree-diff.ts Bun.file path traversal

Possible ATT&CK Techniques 1AI

Affected Version Matrix 48

I. Basic Information for CVE-2026-8765

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-8765

III. Intelligence Information for CVE-2026-8765

IV. Related Vulnerabilities

V. Comments for CVE-2026-8765

Leave a comment