CVE-2026-8770

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8770", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-05-17T09:30:17.576Z", "datePublished": "2026-05-17T23:15:15.257Z", "dateUpdated": "2026-05-18T19:53:49.716Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-17T23:15:15.257Z"}, "title": "continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "Path Traversal"}]}], "affected": [{"vendor": "continuedev", "product": "continue", "versions": [{"version": "1.2.0", "status": "affected"}, {"version": "1.2.1", "status": "affected"}, {"version": "1.2.2", "status": "affected"}, {"version": "1.2.3", "status": "affected"}, {"version": "1.2.4", "status": "affected"}, {"version": "1.2.5", "status": "affected"}, {"version": "1.2.6", "status": "affected"}, {"version": "1.2.7", "status": "affected"}, {"version": "1.2.8", "status": "affected"}, {"version": "1.2.9", "status": "affected"}, {"version": "1.2.10", "status": "affected"}, {"version": "1.2.11", "status": "affected"}, {"version": "1.2.12", "status": "affected"}, {"version": "1.2.13", "status": "affected"}, {"version": "1.2.14", "status": "affected"}, {"version": "1.2.15", "status": "affected"}, {"version": "1.2.16", "status": "affected"}, {"version": "1.2.17", "status": "affected"}, {"version": "1.2.18", "status": "affected"}, {"version": "1.2.19", "status": "affected"}, {"version": "1.2.20", "status": "affected"}, {"version": "1.2.21", "status": "affected"}, {"version": "1.2.22", "status": "affected"}], "cpes": ["cpe:2.3:a:continuedev:continue:*:*:*:*:*:*:*:*"], "modules": ["JSON-RPC Server"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-05-17T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-05-17T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-05-17T11:35:21.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Eric-g (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/364395", "name": "VDB-364395 | continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/364395/cti", "name": "VDB-364395 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/811428", "name": "Submit #811428 | continuedev continue v1.2.22-vscode Path Traversal (CWE-22)", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/YLChen-007/da04e032993a4b2324df915f9ecf9831", "tags": ["exploit"]}]}, "adp": [{"references": [{"url": "https://vuldb.com/submit/811428", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-18T19:51:58.409644Z", "id": "CVE-2026-8770", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-18T19:53:49.716Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal", "credits": [{"lang": "en", "type": "reporter", "value": "Eric-g (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:continuedev:continue:*:*:*:*:*:*:*:*"], "vendor": "continuedev", "modules": ["JSON-RPC Server"], "product": "continue", "versions": [{"status": "affected", "version": "1.2.0"}, {"status": "affected", "version": "1.2.1"}, {"status": "affected", "version": "1.2.2"}, {"status": "affected", "version": "1.2.3"}, {"status": "affected", "version": "1.2.4"}, {"status": "affected", "version": "1.2.5"}, {"status": "affected", "version": "1.2.6"}, {"status": "affected", "version": "1.2.7"}, {"status": "affected", "version": "1.2.8"}, {"status": "affected", "version": "1.2.9"}, {"status": "affected", "version": "1.2.10"}, {"status": "affected", "version": "1.2.11"}, {"status": "affected", "version": "1.2.12"}, {"status": "affected", "version": "1.2.13"}, {"status": "affected", "version": "1.2.14"}, {"status": "affected", "version": "1.2.15"}, {"status": "affected", "version": "1.2.16"}, {"status": "affected", "version": "1.2.17"}, {"status": "affected", "version": "1.2.18"}, {"status": "affected", "version": "1.2.19"}, {"status": "affected", "version": "1.2.20"}, {"status": "affected", "version": "1.2.21"}, {"status": "affected", "version": "1.2.22"}]}], "timeline": [{"lang": "en", "time": "2026-05-17T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-05-17T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-05-17T11:35:21.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/364395", "name": "VDB-364395 | continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/364395/cti", "name": "VDB-364395 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/811428", "name": "Submit #811428 | continuedev continue v1.2.22-vscode Path Traversal (CWE-22)", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/YLChen-007/da04e032993a4b2324df915f9ecf9831", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Path Traversal"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-17T23:15:15.257Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-8770", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-18T19:51:58.409644Z"}}}], "references": [{"url": "https://vuldb.com/submit/811428", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-05-18T19:52:03.840Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-8770", "state": "PUBLISHED", "dateUpdated": "2026-05-17T23:15:15.257Z", "dateReserved": "2026-05-17T09:30:17.576Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-05-17T23:15:15.257Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:continuedev:continue:*:*:*:*:*:*:*:*"], "modules": ["JSON-RPC Server"], "product": "continue", "vendor": "continuedev", "versions": [{"status": "affected", "version": "1.2.0"}, {"status": "affected", "version": "1.2.1"}, {"status": "affected", "version": "1.2.2"}, {"status": "affected", "version": "1.2.3"}, {"status": "affected", "version": "1.2.4"}, {"status": "affected", "version": "1.2.5"}, {"status": "affected", "version": "1.2.6"}, {"status": "affected", "version": "1.2.7"}, {"status": "affected", "version": "1.2.8"}, {"status": "affected", "version": "1.2.9"}, {"status": "affected", "version": "1.2.10"}, {"status": "affected", "version": "1.2.11"}, {"status": "affected", "version": "1.2.12"}, {"status": "affected", "version": "1.2.13"}, {"status": "affected", "version": "1.2.14"}, {"status": "affected", "version": "1.2.15"}, {"status": "affected", "version": "1.2.16"}, {"status": "affected", "version": "1.2.17"}, {"status": "affected", "version": "1.2.18"}, {"status": "affected", "version": "1.2.19"}, {"status": "affected", "version": "1.2.20"}, {"status": "affected", "version": "1.2.21"}, {"status": "affected", "version": "1.2.22"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:continue:continue:*:*:*:*:*:visual_studio_code:*:*", "matchCriteriaId": "1DB788B1-D5B2-4876-BCE2-6144CE16F22B", "versionEndIncluding": "1.2.22", "versionStartIncluding": "1.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se identific\u00f3 una vulnerabilidad en continuedev continue hasta la versi\u00f3n 1.2.22. Esto afecta a la funci\u00f3n lsTool del archivo core/tools/implementations/lsTool.ts del componente JSON-RPC Server. Dicha manipulaci\u00f3n del argumento dirPath conduce a un salto de ruta. Un ataque debe ser abordado localmente. El exploit est\u00e1 disponible p\u00fablicamente y podr\u00eda ser utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-8770", "lastModified": "2026-10-14T20:10:00.190", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 1.7, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8770", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-18T19:51:58.409644Z", "version": "2.0.3"}}]}, "published": "2026-05-18T00:16:37.343", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://gist.github.com/YLChen-007/da04e032993a4b2324df915f9ecf9831"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/submit/811428"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/vuln/364395"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/vuln/364395/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/submit/811428"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.14"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.17"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.18"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.19"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.22"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "continue", "source": "cna", "vendor": "continuedev"}, "product": "continue", "vendor": "continuedev"}], "created": "2026-05-18T01:00:06.665414+00:00", "updated": "2026-05-18T10:48:57.606119+00:00", "vendors": ["continuedev", "continuedev$PRODUCT$continue"]}