CVE-2025-11445

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-11445", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-10-07T13:30:21.029Z", "datePublished": "2025-10-08T08:32:07.925Z", "dateUpdated": "2025-10-08T13:09:54.569Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-10-08T08:32:07.925Z"}, "title": "Kilo Code Prompt ClineProvider.ts ClineProvider injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-707", "lang": "en", "description": "Improper Neutralization"}]}], "affected": [{"vendor": "n/a", "product": "Kilo Code", "versions": [{"version": "4.0", "status": "affected"}, {"version": "4.1", "status": "affected"}, {"version": "4.2", "status": "affected"}, {"version": "4.3", "status": "affected"}, {"version": "4.4", "status": "affected"}, {"version": "4.5", "status": "affected"}, {"version": "4.6", "status": "affected"}, {"version": "4.7", "status": "affected"}, {"version": "4.8", "status": "affected"}, {"version": "4.9", "status": "affected"}, {"version": "4.10", "status": "affected"}, {"version": "4.11", "status": "affected"}, {"version": "4.12", "status": "affected"}, {"version": "4.13", "status": "affected"}, {"version": "4.14", "status": "affected"}, {"version": "4.15", "status": "affected"}, {"version": "4.16", "status": "affected"}, {"version": "4.17", "status": "affected"}, {"version": "4.18", "status": "affected"}, {"version": "4.19", "status": "affected"}, {"version": "4.20", "status": "affected"}, {"version": "4.21", "status": "affected"}, {"version": "4.22", "status": "affected"}, {"version": "4.23", "status": "affected"}, {"version": "4.24", "status": "affected"}, {"version": "4.25", "status": "affected"}, {"version": "4.26", "status": "affected"}, {"version": "4.27", "status": "affected"}, {"version": "4.28", "status": "affected"}, {"version": "4.29", "status": "affected"}, {"version": "4.30", "status": "affected"}, {"version": "4.31", "status": "affected"}, {"version": "4.32", "status": "affected"}, {"version": "4.33", "status": "affected"}, {"version": "4.34", "status": "affected"}, {"version": "4.35", "status": "affected"}, {"version": "4.36", "status": "affected"}, {"version": "4.37", "status": "affected"}, {"version": "4.38", "status": "affected"}, {"version": "4.39", "status": "affected"}, {"version": "4.40", "status": "affected"}, {"version": "4.41", "status": "affected"}, {"version": "4.42", "status": "affected"}, {"version": "4.43", "status": "affected"}, {"version": "4.44", "status": "affected"}, {"version": "4.45", "status": "affected"}, {"version": "4.46", "status": "affected"}, {"version": "4.47", "status": "affected"}, {"version": "4.48", "status": "affected"}, {"version": "4.49", "status": "affected"}, {"version": "4.50", "status": "affected"}, {"version": "4.51", "status": "affected"}, {"version": "4.52", "status": "affected"}, {"version": "4.53", "status": "affected"}, {"version": "4.54", "status": "affected"}, {"version": "4.55", "status": "affected"}, {"version": "4.56", "status": "affected"}, {"version": "4.57", "status": "affected"}, {"version": "4.58", "status": "affected"}, {"version": "4.59", "status": "affected"}, {"version": "4.60", "status": "affected"}, {"version": "4.61", "status": "affected"}, {"version": "4.62", "status": "affected"}, {"version": "4.63", "status": "affected"}, {"version": "4.64", "status": "affected"}, {"version": "4.65", "status": "affected"}, {"version": "4.66", "status": "affected"}, {"version": "4.67", "status": "affected"}, {"version": "4.68", "status": "affected"}, {"version": "4.69", "status": "affected"}, {"version": "4.70", "status": "affected"}, {"version": "4.71", "status": "affected"}, {"version": "4.72", "status": "affected"}, {"version": "4.73", "status": "affected"}, {"version": "4.74", "status": "affected"}, {"version": "4.75", "status": "affected"}, {"version": "4.76", "status": "affected"}, {"version": "4.77", "status": "affected"}, {"version": "4.78", "status": "affected"}, {"version": "4.79", "status": "affected"}, {"version": "4.80", "status": "affected"}, {"version": "4.81", "status": "affected"}, {"version": "4.82", "status": "affected"}, {"version": "4.83", "status": "affected"}, {"version": "4.84", "status": "affected"}, {"version": "4.85", "status": "affected"}, {"version": "4.86.0", "status": "affected"}], "modules": ["Prompt Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Kilo Code up to 4.86.0. Affected is the function ClineProvider of the file src/core/webview/ClineProvider.ts of the component Prompt Handler. Performing manipulation results in injection. The attack can be initiated remotely. The exploit is now public and may be used. Applying a patch is the recommended action to fix this issue."}, {"lang": "de", "value": "In Kilo Code up to 4.86.0 wurde eine Schwachstelle gefunden. Es ist betroffen die Funktion ClineProvider der Datei src/core/webview/ClineProvider.ts der Komponente Prompt Handler. Mittels Manipulieren mit unbekannten Daten kann eine injection-Schwachstelle ausgenutzt werden. Es ist m\u00f6glich, den Angriff aus der Ferne durchzuf\u00fchren. Die Schwachstelle wurde \u00f6ffentlich offengelegt und k\u00f6nnte ausgenutzt werden. Es wird geraten, einen Patch zu installieren, um dieses Problem zu l\u00f6sen."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2025-10-07T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-10-07T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-10-07T15:35:25.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "echarris128 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.327382", "name": "VDB-327382 | Kilo Code Prompt ClineProvider.ts ClineProvider injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.327382", "name": "VDB-327382 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.667004", "name": "Submit #667004 | Kilo Code Kilo Code VS Code Extension 4.86.0 Insecure Permissions", "tags": ["third-party-advisory"]}, {"url": "https://mcpsec.dev/advisories/2025-10-02-kilo-code-ai-agent-supply-chain-attack/", "tags": ["exploit"]}, {"url": "https://github.com/Kilo-Org/kilocode/pull/2244", "tags": ["issue-tracking"]}, {"url": "https://github.com/Kilo-Org/kilocode/pull/2244/commits/2fdddf89edba41ec3a527134e485a3388c464333", "tags": ["issue-tracking", "patch"]}]}, "adp": [{"references": [{"url": "https://mcpsec.dev/advisories/2025-10-02-kilo-code-ai-agent-supply-chain-attack/", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-08T13:09:51.795439Z", "id": "CVE-2025-11445", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-08T13:09:54.569Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11445", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-08T13:09:51.795439Z"}}}], "references": [{"url": "https://mcpsec.dev/advisories/2025-10-02-kilo-code-ai-agent-supply-chain-attack/", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-08T13:09:47.356Z"}}], "cna": {"title": "Kilo Code Prompt ClineProvider.ts ClineProvider injection", "credits": [{"lang": "en", "type": "reporter", "value": "echarris128 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C"}}], "affected": [{"vendor": "n/a", "modules": ["Prompt Handler"], "product": "Kilo Code", "versions": [{"status": "affected", "version": "4.0"}, {"status": "affected", "version": "4.1"}, {"status": "affected", "version": "4.2"}, {"status": "affected", "version": "4.3"}, {"status": "affected", "version": "4.4"}, {"status": "affected", "version": "4.5"}, {"status": "affected", "version": "4.6"}, {"status": "affected", "version": "4.7"}, {"status": "affected", "version": "4.8"}, {"status": "affected", "version": "4.9"}, {"status": "affected", "version": "4.10"}, {"status": "affected", "version": "4.11"}, {"status": "affected", "version": "4.12"}, {"status": "affected", "version": "4.13"}, {"status": "affected", "version": "4.14"}, {"status": "affected", "version": "4.15"}, {"status": "affected", "version": "4.16"}, {"status": "affected", "version": "4.17"}, {"status": "affected", "version": "4.18"}, {"status": "affected", "version": "4.19"}, {"status": "affected", "version": "4.20"}, {"status": "affected", "version": "4.21"}, {"status": "affected", "version": "4.22"}, {"status": "affected", "version": "4.23"}, {"status": "affected", "version": "4.24"}, {"status": "affected", "version": "4.25"}, {"status": "affected", "version": "4.26"}, {"status": "affected", "version": "4.27"}, {"status": "affected", "version": "4.28"}, {"status": "affected", "version": "4.29"}, {"status": "affected", "version": "4.30"}, {"status": "affected", "version": "4.31"}, {"status": "affected", "version": "4.32"}, {"status": "affected", "version": "4.33"}, {"status": "affected", "version": "4.34"}, {"status": "affected", "version": "4.35"}, {"status": "affected", "version": "4.36"}, {"status": "affected", "version": "4.37"}, {"status": "affected", "version": "4.38"}, {"status": "affected", "version": "4.39"}, {"status": "affected", "version": "4.40"}, {"status": "affected", "version": "4.41"}, {"status": "affected", "version": "4.42"}, {"status": "affected", "version": "4.43"}, {"status": "affected", "version": "4.44"}, {"status": "affected", "version": "4.45"}, {"status": "affected", "version": "4.46"}, {"status": "affected", "version": "4.47"}, {"status": "affected", "version": "4.48"}, {"status": "affected", "version": "4.49"}, {"status": "affected", "version": "4.50"}, {"status": "affected", "version": "4.51"}, {"status": "affected", "version": "4.52"}, {"status": "affected", "version": "4.53"}, {"status": "affected", "version": "4.54"}, {"status": "affected", "version": "4.55"}, {"status": "affected", "version": "4.56"}, {"status": "affected", "version": "4.57"}, {"status": "affected", "version": "4.58"}, {"status": "affected", "version": "4.59"}, {"status": "affected", "version": "4.60"}, {"status": "affected", "version": "4.61"}, {"status": "affected", "version": "4.62"}, {"status": "affected", "version": "4.63"}, {"status": "affected", "version": "4.64"}, {"status": "affected", "version": "4.65"}, {"status": "affected", "version": "4.66"}, {"status": "affected", "version": "4.67"}, {"status": "affected", "version": "4.68"}, {"status": "affected", "version": "4.69"}, {"status": "affected", "version": "4.70"}, {"status": "affected", "version": "4.71"}, {"status": "affected", "version": "4.72"}, {"status": "affected", "version": "4.73"}, {"status": "affected", "version": "4.74"}, {"status": "affected", "version": "4.75"}, {"status": "affected", "version": "4.76"}, {"status": "affected", "version": "4.77"}, {"status": "affected", "version": "4.78"}, {"status": "affected", "version": "4.79"}, {"status": "affected", "version": "4.80"}, {"status": "affected", "version": "4.81"}, {"status": "affected", "version": "4.82"}, {"status": "affected", "version": "4.83"}, {"status": "affected", "version": "4.84"}, {"status": "affected", "version": "4.85"}, {"status": "affected", "version": "4.86.0"}]}], "timeline": [{"lang": "en", "time": "2025-10-07T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-10-07T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2025-10-07T15:35:25.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.327382", "name": "VDB-327382 | Kilo Code Prompt ClineProvider.ts ClineProvider injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.327382", "name": "VDB-327382 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.667004", "name": "Submit #667004 | Kilo Code Kilo Code VS Code Extension 4.86.0 Insecure Permissions", "tags": ["third-party-advisory"]}, {"url": "https://mcpsec.dev/advisories/2025-10-02-kilo-code-ai-agent-supply-chain-attack/", "tags": ["exploit"]}, {"url": "https://github.com/Kilo-Org/kilocode/pull/2244", "tags": ["issue-tracking"]}, {"url": "https://github.com/Kilo-Org/kilocode/pull/2244/commits/2fdddf89edba41ec3a527134e485a3388c464333", "tags": ["issue-tracking", "patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Kilo Code up to 4.86.0. Affected is the function ClineProvider of the file src/core/webview/ClineProvider.ts of the component Prompt Handler. Performing manipulation results in injection. The attack can be initiated remotely. The exploit is now public and may be used. Applying a patch is the recommended action to fix this issue."}, {"lang": "de", "value": "In Kilo Code up to 4.86.0 wurde eine Schwachstelle gefunden. Es ist betroffen die Funktion ClineProvider der Datei src/core/webview/ClineProvider.ts der Komponente Prompt Handler. Mittels Manipulieren mit unbekannten Daten kann eine injection-Schwachstelle ausgenutzt werden. Es ist m\u00f6glich, den Angriff aus der Ferne durchzuf\u00fchren. Die Schwachstelle wurde \u00f6ffentlich offengelegt und k\u00f6nnte ausgenutzt werden. Es wird geraten, einen Patch zu installieren, um dieses Problem zu l\u00f6sen."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-707", "description": "Improper Neutralization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-10-08T08:32:07.925Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11445", "state": "PUBLISHED", "dateUpdated": "2025-10-08T13:09:54.569Z", "dateReserved": "2025-10-07T13:30:21.029Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-10-08T08:32:07.925Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"modules": ["Prompt Handler"], "product": "Kilo Code", "vendor": "n/a", "versions": [{"status": "affected", "version": "4.0"}, {"status": "affected", "version": "4.1"}, {"status": "affected", "version": "4.2"}, {"status": "affected", "version": "4.3"}, {"status": "affected", "version": "4.4"}, {"status": "affected", "version": "4.5"}, {"status": "affected", "version": "4.6"}, {"status": "affected", "version": "4.7"}, {"status": "affected", "version": "4.8"}, {"status": "affected", "version": "4.9"}, {"status": "affected", "version": "4.10"}, {"status": "affected", "version": "4.11"}, {"status": "affected", "version": "4.12"}, {"status": "affected", "version": "4.13"}, {"status": "affected", "version": "4.14"}, {"status": "affected", "version": "4.15"}, {"status": "affected", "version": "4.16"}, {"status": "affected", "version": "4.17"}, {"status": "affected", "version": "4.18"}, {"status": "affected", "version": "4.19"}, {"status": "affected", "version": "4.20"}, {"status": "affected", "version": "4.21"}, {"status": "affected", "version": "4.22"}, {"status": "affected", "version": "4.23"}, {"status": "affected", "version": "4.24"}, {"status": "affected", "version": "4.25"}, {"status": "affected", "version": "4.26"}, {"status": "affected", "version": "4.27"}, {"status": "affected", "version": "4.28"}, {"status": "affected", "version": "4.29"}, {"status": "affected", "version": "4.30"}, {"status": "affected", "version": "4.31"}, {"status": "affected", "version": "4.32"}, {"status": "affected", "version": "4.33"}, {"status": "affected", "version": "4.34"}, {"status": "affected", "version": "4.35"}, {"status": "affected", "version": "4.36"}, {"status": "affected", "version": "4.37"}, {"status": "affected", "version": "4.38"}, {"status": "affected", "version": "4.39"}, {"status": "affected", "version": "4.40"}, {"status": "affected", "version": "4.41"}, {"status": "affected", "version": "4.42"}, {"status": "affected", "version": "4.43"}, {"status": "affected", "version": "4.44"}, {"status": "affected", "version": "4.45"}, {"status": "affected", "version": "4.46"}, {"status": "affected", "version": "4.47"}, {"status": "affected", "version": "4.48"}, {"status": "affected", "version": "4.49"}, {"status": "affected", "version": "4.50"}, {"status": "affected", "version": "4.51"}, {"status": "affected", "version": "4.52"}, {"status": "affected", "version": "4.53"}, {"status": "affected", "version": "4.54"}, {"status": "affected", "version": "4.55"}, {"status": "affected", "version": "4.56"}, {"status": "affected", "version": "4.57"}, {"status": "affected", "version": "4.58"}, {"status": "affected", "version": "4.59"}, {"status": "affected", "version": "4.60"}, {"status": "affected", "version": "4.61"}, {"status": "affected", "version": "4.62"}, {"status": "affected", "version": "4.63"}, {"status": "affected", "version": "4.64"}, {"status": "affected", "version": "4.65"}, {"status": "affected", "version": "4.66"}, {"status": "affected", "version": "4.67"}, {"status": "affected", "version": "4.68"}, {"status": "affected", "version": "4.69"}, {"status": "affected", "version": "4.70"}, {"status": "affected", "version": "4.71"}, {"status": "affected", "version": "4.72"}, {"status": "affected", "version": "4.73"}, {"status": "affected", "version": "4.74"}, {"status": "affected", "version": "4.75"}, {"status": "affected", "version": "4.76"}, {"status": "affected", "version": "4.77"}, {"status": "affected", "version": "4.78"}, {"status": "affected", "version": "4.79"}, {"status": "affected", "version": "4.80"}, {"status": "affected", "version": "4.81"}, {"status": "affected", "version": "4.82"}, {"status": "affected", "version": "4.83"}, {"status": "affected", "version": "4.84"}, {"status": "affected", "version": "4.85"}, {"status": "affected", "version": "4.86.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in Kilo Code up to 4.86.0. Affected is the function ClineProvider of the file src/core/webview/ClineProvider.ts of the component Prompt Handler. Performing manipulation results in injection. The attack can be initiated remotely. The exploit is now public and may be used. Applying a patch is the recommended action to fix this issue."}, {"lang": "es", "value": "Una vulnerabilidad fue detectada en Kilo Code hasta 4.86.0. Afectada es la funci\u00f3n ClineProvider del archivo src/core/webview/ClineProvider.ts del componente Prompt Handler. Realizar manipulaci\u00f3n resulta en inyecci\u00f3n. El ataque puede ser iniciado remotamente. El exploit es ahora p\u00fablico y puede ser usado. Aplicar un parche es la acci\u00f3n recomendada para solucionar este problema."}], "id": "CVE-2025-11445", "lastModified": "2026-10-19T16:10:00.260", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11445", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-08T13:09:51.795439Z", "version": "2.0.3"}}]}, "published": "2025-10-08T09:15:33.013", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/Kilo-Org/kilocode/pull/2244"}, {"source": "cna@vuldb.com", "url": "https://github.com/Kilo-Org/kilocode/pull/2244/commits/2fdddf89edba41ec3a527134e485a3388c464333"}, {"source": "cna@vuldb.com", "url": "https://mcpsec.dev/advisories/2025-10-02-kilo-code-ai-agent-supply-chain-attack/"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.327382"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.327382"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.667004"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://mcpsec.dev/advisories/2025-10-02-kilo-code-ai-agent-supply-chain-attack/"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-707"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"created": "2025-10-09T12:51:49.956665+00:00", "updated": "2025-10-09T12:51:49.956691+00:00", "vendors": ["kilo", "kilo$PRODUCT$kilo_code"]}