Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by continuedev

    CVE-2026-8770 (GCVE-0-2026-8770)

    Vulnerability from nvd – Published: 2026-05-17 23:15 – Updated: 2026-05-18 19:53
    VLAI
    Title
    continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal
    Summary
    A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
    Severity
    4.8 (Medium)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
    3.3 (Low)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    3.3 (Low)
    CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    References
    URL Tags
    https://vuldb.com/vuln/364395 vdb-entrytechnical-description
    https://vuldb.com/vuln/364395/cti signaturepermissions-required
    https://vuldb.com/submit/811428 third-party-advisory
    https://gist.github.com/YLChen-007/da04e032993a4b… exploit
    Impacted products
    Vendor Product Version
    continuedev continue Affected: 1.2.0
    Affected: 1.2.1
    Affected: 1.2.2
    Affected: 1.2.3
    Affected: 1.2.4
    Affected: 1.2.5
    Affected: 1.2.6
    Affected: 1.2.7
    Affected: 1.2.8
    Affected: 1.2.9
    Affected: 1.2.10
    Affected: 1.2.11
    Affected: 1.2.12
    Affected: 1.2.13
    Affected: 1.2.14
    Affected: 1.2.15
    Affected: 1.2.16
    Affected: 1.2.17
    Affected: 1.2.18
    Affected: 1.2.19
    Affected: 1.2.20
    Affected: 1.2.21
    Affected: 1.2.22
        cpe:2.3:a:continuedev:continue:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Credits
    Eric-g (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8770",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-18T19:51:58.409644Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-18T19:53:49.716Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://vuldb.com/submit/811428"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:continuedev:continue:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "JSON-RPC Server"
          ],
          "product": "continue",
          "vendor": "continuedev",
          "versions": [
            {
              "status": "affected",
              "version": "1.2.0"
            },
            {
              "status": "affected",
              "version": "1.2.1"
            },
            {
              "status": "affected",
              "version": "1.2.2"
            },
            {
              "status": "affected",
              "version": "1.2.3"
            },
            {
              "status": "affected",
              "version": "1.2.4"
            },
            {
              "status": "affected",
              "version": "1.2.5"
            },
            {
              "status": "affected",
              "version": "1.2.6"
            },
            {
              "status": "affected",
              "version": "1.2.7"
            },
            {
              "status": "affected",
              "version": "1.2.8"
            },
            {
              "status": "affected",
              "version": "1.2.9"
            },
            {
              "status": "affected",
              "version": "1.2.10"
            },
            {
              "status": "affected",
              "version": "1.2.11"
            },
            {
              "status": "affected",
              "version": "1.2.12"
            },
            {
              "status": "affected",
              "version": "1.2.13"
            },
            {
              "status": "affected",
              "version": "1.2.14"
            },
            {
              "status": "affected",
              "version": "1.2.15"
            },
            {
              "status": "affected",
              "version": "1.2.16"
            },
            {
              "status": "affected",
              "version": "1.2.17"
            },
            {
              "status": "affected",
              "version": "1.2.18"
            },
            {
              "status": "affected",
              "version": "1.2.19"
            },
            {
              "status": "affected",
              "version": "1.2.20"
            },
            {
              "status": "affected",
              "version": "1.2.21"
            },
            {
              "status": "affected",
              "version": "1.2.22"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Eric-g (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.7,
            "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-17T23:15:15.257Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-364395 | continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/364395"
        },
        {
          "name": "VDB-364395 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/364395/cti"
        },
        {
          "name": "Submit #811428 | continuedev continue v1.2.22-vscode Path Traversal (CWE-22)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/811428"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/YLChen-007/da04e032993a4b2324df915f9ecf9831"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-17T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-05-17T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-05-17T11:35:21.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-8770",
    "datePublished": "2026-05-17T23:15:15.257Z",
    "dateReserved": "2026-05-17T09:30:17.576Z",
    "dateUpdated": "2026-05-18T19:53:49.716Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-8770 (GCVE-0-2026-8770)

    Vulnerability from cvelistv5 – Published: 2026-05-17 23:15 – Updated: 2026-05-18 19:53
    VLAI
    Title
    continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal
    Summary
    A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
    Severity
    4.8 (Medium)
    CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
    3.3 (Low)
    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    3.3 (Low)
    CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator (v2.0.3)
    CWE
    Assigner
    References
    URL Tags
    https://vuldb.com/vuln/364395 vdb-entrytechnical-description
    https://vuldb.com/vuln/364395/cti signaturepermissions-required
    https://vuldb.com/submit/811428 third-party-advisory
    https://gist.github.com/YLChen-007/da04e032993a4b… exploit
    Impacted products
    Vendor Product Version
    continuedev continue Affected: 1.2.0
    Affected: 1.2.1
    Affected: 1.2.2
    Affected: 1.2.3
    Affected: 1.2.4
    Affected: 1.2.5
    Affected: 1.2.6
    Affected: 1.2.7
    Affected: 1.2.8
    Affected: 1.2.9
    Affected: 1.2.10
    Affected: 1.2.11
    Affected: 1.2.12
    Affected: 1.2.13
    Affected: 1.2.14
    Affected: 1.2.15
    Affected: 1.2.16
    Affected: 1.2.17
    Affected: 1.2.18
    Affected: 1.2.19
    Affected: 1.2.20
    Affected: 1.2.21
    Affected: 1.2.22
        cpe:2.3:a:continuedev:continue:*:*:*:*:*:*:*:*
    		 Create a notification for this product.
    Credits
    Eric-g (VulDB User) VulDB CNA Team
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8770",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-18T19:51:58.409644Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-18T19:53:49.716Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://vuldb.com/submit/811428"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:continuedev:continue:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "JSON-RPC Server"
          ],
          "product": "continue",
          "vendor": "continuedev",
          "versions": [
            {
              "status": "affected",
              "version": "1.2.0"
            },
            {
              "status": "affected",
              "version": "1.2.1"
            },
            {
              "status": "affected",
              "version": "1.2.2"
            },
            {
              "status": "affected",
              "version": "1.2.3"
            },
            {
              "status": "affected",
              "version": "1.2.4"
            },
            {
              "status": "affected",
              "version": "1.2.5"
            },
            {
              "status": "affected",
              "version": "1.2.6"
            },
            {
              "status": "affected",
              "version": "1.2.7"
            },
            {
              "status": "affected",
              "version": "1.2.8"
            },
            {
              "status": "affected",
              "version": "1.2.9"
            },
            {
              "status": "affected",
              "version": "1.2.10"
            },
            {
              "status": "affected",
              "version": "1.2.11"
            },
            {
              "status": "affected",
              "version": "1.2.12"
            },
            {
              "status": "affected",
              "version": "1.2.13"
            },
            {
              "status": "affected",
              "version": "1.2.14"
            },
            {
              "status": "affected",
              "version": "1.2.15"
            },
            {
              "status": "affected",
              "version": "1.2.16"
            },
            {
              "status": "affected",
              "version": "1.2.17"
            },
            {
              "status": "affected",
              "version": "1.2.18"
            },
            {
              "status": "affected",
              "version": "1.2.19"
            },
            {
              "status": "affected",
              "version": "1.2.20"
            },
            {
              "status": "affected",
              "version": "1.2.21"
            },
            {
              "status": "affected",
              "version": "1.2.22"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Eric-g (VulDB User)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "VulDB CNA Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 1.7,
            "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-17T23:15:15.257Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-364395 | continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/364395"
        },
        {
          "name": "VDB-364395 | CTI Indicators (IOB, IOC, TTP, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/364395/cti"
        },
        {
          "name": "Submit #811428 | continuedev continue v1.2.22-vscode Path Traversal (CWE-22)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/811428"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gist.github.com/YLChen-007/da04e032993a4b2324df915f9ecf9831"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-17T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-05-17T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-05-17T11:35:21.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-8770",
    "datePublished": "2026-05-17T23:15:15.257Z",
    "dateReserved": "2026-05-17T09:30:17.576Z",
    "dateUpdated": "2026-05-18T19:53:49.716Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}