What’s Vulnerable › Vulnerabilities

CVE-2026-8770: continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-05-18 · updated 2026-10-14
• Weakness: CWE-22

Description

A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

• continuedev continue: from 1.2.0 through 1.2.22

References

• https://gist.github.com/YLChen-007/da04e032993a4b2324df915f9ecf9831
• https://vuldb.com/submit/811428
• https://vuldb.com/vuln/364395
• https://vuldb.com/vuln/364395/cti
• https://vuldb.com/submit/811428

Get alerted when CVE-2026-8770 or the next vulnerability affects your stack