CVE-2026-8770

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-8770

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8770.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-8770

Published

2026-05-17T23:15:15.257Z

Modified

2026-07-15T01:49:13.849354556Z

Severity

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal

Details

A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.2.0"
                },
                {
                    "last_affected": "1.2.0"
                },
                {
                    "introduced": "1.2.1"
                },
                {
                    "last_affected": "1.2.1"
                },
                {
                    "introduced": "1.2.2"
                },
                {
                    "last_affected": "1.2.2"
                },
                {
                    "introduced": "1.2.3"
                },
                {
                    "last_affected": "1.2.3"
                },
                {
                    "introduced": "1.2.4"
                },
                {
                    "last_affected": "1.2.4"
                },
                {
                    "introduced": "1.2.5"
                },
                {
                    "last_affected": "1.2.5"
                },
                {
                    "introduced": "1.2.6"
                },
                {
                    "last_affected": "1.2.6"
                },
                {
                    "introduced": "1.2.7"
                },
                {
                    "last_affected": "1.2.7"
                },
                {
                    "introduced": "1.2.8"
                },
                {
                    "last_affected": "1.2.8"
                },
                {
                    "introduced": "1.2.9"
                },
                {
                    "last_affected": "1.2.9"
                },
                {
                    "introduced": "1.2.10"
                },
                {
                    "last_affected": "1.2.10"
                },
                {
                    "introduced": "1.2.11"
                },
                {
                    "last_affected": "1.2.11"
                },
                {
                    "introduced": "1.2.12"
                },
                {
                    "last_affected": "1.2.12"
                },
                {
                    "introduced": "1.2.13"
                },
                {
                    "last_affected": "1.2.13"
                },
                {
                    "introduced": "1.2.14"
                },
                {
                    "last_affected": "1.2.14"
                },
                {
                    "introduced": "1.2.15"
                },
                {
                    "last_affected": "1.2.15"
                },
                {
                    "introduced": "1.2.16"
                },
                {
                    "last_affected": "1.2.16"
                },
                {
                    "introduced": "1.2.17"
                },
                {
                    "last_affected": "1.2.17"
                },
                {
                    "introduced": "1.2.18"
                },
                {
                    "last_affected": "1.2.18"
                },
                {
                    "introduced": "1.2.19"
                },
                {
                    "last_affected": "1.2.19"
                },
                {
                    "introduced": "1.2.20"
                },
                {
                    "last_affected": "1.2.20"
                },
                {
                    "introduced": "1.2.21"
                },
                {
                    "last_affected": "1.2.21"
                },
                {
                    "introduced": "1.2.22"
                },
                {
                    "last_affected": "1.2.22"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8770.json"
}

References

Affected packages

Git / github.com/continuedev/continue

Affected ranges

Type

GIT

Repo

https://github.com/continuedev/continue

Events

Introduced

c75c082289505c7ac5bb347d2c12ae64fc6be19e

Last affected

5607a67ae46e2e1edcf54c44fca81ea75c27b372

Database specific

{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "1.2.0"
        },
        {
            "last_affected": "1.2.22"
        }
    ],
    "cpe": "cpe:2.3:a:continue:continue:*:*:*:*:*:visual_studio_code:*:*"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8770.json"