CVE-2026-8766— Kilo-Org kilocode Environment Variable config.ts load information disclosure

CVSS 4.3 · Medium EPSS 0.03% · P9 Updated May 19, 2026

Possible ATT&CK Techniques 1AI

Affected Version Matrix 48

Vendor	Product	Version Range	Status
Kilo-Org	kilocode	`7.0.0`	affected
		`7.0.1`	affected
		`7.0.2`	affected
		`7.0.3`	affected
		`7.0.4`	affected
		`7.0.5`	affected
		`7.0.6`	affected
		`7.0.7`	affected
… +40 more rows

Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-8766

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Kilo-Org kilocode Environment Variable config.ts load information disclosure

Source: NVD (National Vulnerability Database)

Vulnerability Description

A flaw has been found in Kilo-Org kilocode up to 7.0.47. This issue affects the function Load of the file packages/opencode/src/config/config.ts of the component Environment Variable Handler. Executing a manipulation of the argument KILO_CONFIG_CONTENT can lead to information disclosure. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Source: NVD (National Vulnerability Database)

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: NVD (National Vulnerability Database)

Vulnerability Type

信息暴露

Source: NVD (National Vulnerability Database)

Vulnerability Title

Kilo Code 信息泄露漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Kilo Code是Kilo Code开源的一个AI编码助手。 Kilo Code 7.0.47及之前版本存在信息泄露漏洞，该漏洞源于Environment Variable Handler组件中config.ts文件的Load函数对参数KILO_CONFIG_CONTENT处理不当，导致信息泄露。攻击者可能远程利用此漏洞。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Kilo-Org	kilocode	7.0.0	`cpe:2.3:a:kilo-org:kilocode::::::::`

II. Public POCs for CVE-2026-8766

#	POC Description	Source Link	Shenlong Link

AI-Generated POCPremium

No public POC found.

III. Intelligence Information for CVE-2026-8766

请登录查看更多情报信息。

Proof of Concept for CVE-2026-8766 (1)

Arbitrary File Read and Sensitive Data Leak via Incomplete Remediation of Token Substitution in `KILO_CONFIG_CONTENT` Environment Variable · GitHubexploit

https://nvd.nist.gov/vuln/detail/CVE-2026-8766

IV. Related Vulnerabilities

Same product: kilocode

CVE-2026-8765
Kilo-Org kilocode File Diff API Endpoint worktree-diff.ts Bu

Same vendor: Kilo-Org

CVE-2026-8765
Kilo-Org kilocode File Diff API Endpoint worktree-diff.ts Bu

Same weakness: CWE-200

V. Comments for CVE-2026-8766

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-8766— Kilo-Org kilocode Environment Variable config.ts load information disclosure

Possible ATT&CK Techniques 1AI

Affected Version Matrix 48

I. Basic Information for CVE-2026-8766

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-8766

III. Intelligence Information for CVE-2026-8766

Proof of Concept for CVE-2026-8766 (1)

IV. Related Vulnerabilities

V. Comments for CVE-2026-8766

Leave a comment