PT-2026-41586 · Kilo Org · Kilo Code

Eric-D · CVE-2026-8766 · Published 2026-05-17 · Updated 2026-05-19

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kilo-Org kilocode versions prior to 7.0.48

Description A flaw in the Environment Variable Handler component allows remote information disclosure. The issue exists within the Load() function located in the packages/opencode/src/config/config.ts file. An attacker can trigger this by manipulating the KILO CONFIG CONTENT argument.

Recommendations Update to a version newer than 7.0.47. As a temporary workaround, restrict or monitor the use of the KILO CONFIG CONTENT argument to minimize the risk of information disclosure.

Exploit

Fix

Information Disclosure

Improper Access Control

Weakness Enumeration

CWE-200

CWE-284

Related Identifiers

CVE-2026-8766

GHSA-RPC6-9C4P-J5CG

Affected Products

Kilo Code

References · 12

• 🔥 https://vuldb.com/submit/811400 · Exploit
• 🔥 https://gist.github.com/YLChen-007/32b444e49ced1a46bde5a68933ccd09f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-8766 · Security Note
• https://osv.dev/vulnerability/GHSA-rpc6-9c4p-j5cg · Vendor Advisory
• https://github.com/Kilo-Org/kilocode · Note
• https://twitter.com/VulmonFeeds/status/2056164081355067589 · Twitter Post
• https://vuldb.com/vuln/364391/cti · Note
• https://vuldb.com/vuln/364391 · Note
• https://t.me/cveNotify/164114 · Telegram Post
• https://t.me/CVEtracker/54076 · Telegram Post
• https://t.me/cveNotify/163799 · Telegram Post
• https://twitter.com/CVEnew/status/2056253260428706282 · Twitter Post