{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8770", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-05-17T09:30:17.576Z", "datePublished": "2026-05-17T23:15:15.257Z", "dateUpdated": "2026-05-18T19:53:49.716Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-17T23:15:15.257Z"}, "title": "continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "Path Traversal"}]}], "affected": [{"vendor": "continuedev", "product": "continue", "versions": [{"version": "1.2.0", "status": "affected"}, {"version": "1.2.1", "status": "affected"}, {"version": "1.2.2", "status": "affected"}, {"version": "1.2.3", "status": "affected"}, {"version": "1.2.4", "status": "affected"}, {"version": "1.2.5", "status": "affected"}, {"version": "1.2.6", "status": "affected"}, {"version": "1.2.7", "status": "affected"}, {"version": "1.2.8", "status": "affected"}, {"version": "1.2.9", "status": "affected"}, {"version": "1.2.10", "status": "affected"}, {"version": "1.2.11", "status": "affected"}, {"version": "1.2.12", "status": "affected"}, {"version": "1.2.13", "status": "affected"}, {"version": "1.2.14", "status": "affected"}, {"version": "1.2.15", "status": "affected"}, {"version": "1.2.16", "status": "affected"}, {"version": "1.2.17", "status": "affected"}, {"version": "1.2.18", "status": "affected"}, {"version": "1.2.19", "status": "affected"}, {"version": "1.2.20", "status": "affected"}, {"version": "1.2.21", "status": "affected"}, {"version": "1.2.22", "status": "affected"}], "cpes": ["cpe:2.3:a:continuedev:continue:*:*:*:*:*:*:*:*"], "modules": ["JSON-RPC Server"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-05-17T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-05-17T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-05-17T11:35:21.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Eric-g (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/364395", "name": "VDB-364395 | continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/364395/cti", "name": "VDB-364395 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/811428", "name": "Submit #811428 | continuedev continue v1.2.22-vscode Path Traversal (CWE-22)", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/YLChen-007/da04e032993a4b2324df915f9ecf9831", "tags": ["exploit"]}]}, "adp": [{"references": [{"url": "https://vuldb.com/submit/811428", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-18T19:51:58.409644Z", "id": "CVE-2026-8770", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-18T19:53:49.716Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal", "credits": [{"lang": "en", "type": "reporter", "value": "Eric-g (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.3, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 1.7, "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:continuedev:continue:*:*:*:*:*:*:*:*"], "vendor": "continuedev", "modules": ["JSON-RPC Server"], "product": "continue", "versions": [{"status": "affected", "version": "1.2.0"}, {"status": "affected", "version": "1.2.1"}, {"status": "affected", "version": "1.2.2"}, {"status": "affected", "version": "1.2.3"}, {"status": "affected", "version": "1.2.4"}, {"status": "affected", "version": "1.2.5"}, {"status": "affected", "version": "1.2.6"}, {"status": "affected", "version": "1.2.7"}, {"status": "affected", "version": "1.2.8"}, {"status": "affected", "version": "1.2.9"}, {"status": "affected", "version": "1.2.10"}, {"status": "affected", "version": "1.2.11"}, {"status": "affected", "version": "1.2.12"}, {"status": "affected", "version": "1.2.13"}, {"status": "affected", "version": "1.2.14"}, {"status": "affected", "version": "1.2.15"}, {"status": "affected", "version": "1.2.16"}, {"status": "affected", "version": "1.2.17"}, {"status": "affected", "version": "1.2.18"}, {"status": "affected", "version": "1.2.19"}, {"status": "affected", "version": "1.2.20"}, {"status": "affected", "version": "1.2.21"}, {"status": "affected", "version": "1.2.22"}]}], "timeline": [{"lang": "en", "time": "2026-05-17T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-05-17T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-05-17T11:35:21.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/364395", "name": "VDB-364395 | continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/364395/cti", "name": "VDB-364395 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/811428", "name": "Submit #811428 | continuedev continue v1.2.22-vscode Path Traversal (CWE-22)", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/YLChen-007/da04e032993a4b2324df915f9ecf9831", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "Path Traversal"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-17T23:15:15.257Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-8770", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-18T19:51:58.409644Z"}}}], "references": [{"url": "https://vuldb.com/submit/811428", "tags": ["exploit"]}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-05-18T19:52:03.840Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-8770", "state": "PUBLISHED", "dateUpdated": "2026-05-17T23:15:15.257Z", "dateReserved": "2026-05-17T09:30:17.576Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-05-17T23:15:15.257Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:continuedev:continue:*:*:*:*:*:*:*:*"], "modules": ["JSON-RPC Server"], "product": "continue", "vendor": "continuedev", "versions": [{"status": "affected", "version": "1.2.0"}, {"status": "affected", "version": "1.2.1"}, {"status": "affected", "version": "1.2.2"}, {"status": "affected", "version": "1.2.3"}, {"status": "affected", "version": "1.2.4"}, {"status": "affected", "version": "1.2.5"}, {"status": "affected", "version": "1.2.6"}, {"status": "affected", "version": "1.2.7"}, {"status": "affected", "version": "1.2.8"}, {"status": "affected", "version": "1.2.9"}, {"status": "affected", "version": "1.2.10"}, {"status": "affected", "version": "1.2.11"}, {"status": "affected", "version": "1.2.12"}, {"status": "affected", "version": "1.2.13"}, {"status": "affected", "version": "1.2.14"}, {"status": "affected", "version": "1.2.15"}, {"status": "affected", "version": "1.2.16"}, {"status": "affected", "version": "1.2.17"}, {"status": "affected", "version": "1.2.18"}, {"status": "affected", "version": "1.2.19"}, {"status": "affected", "version": "1.2.20"}, {"status": "affected", "version": "1.2.21"}, {"status": "affected", "version": "1.2.22"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:continue:continue:*:*:*:*:*:visual_studio_code:*:*", "matchCriteriaId": "1DB788B1-D5B2-4876-BCE2-6144CE16F22B", "versionEndIncluding": "1.2.22", "versionStartIncluding": "1.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "id": "CVE-2026-8770", "lastModified": "2026-06-17T11:04:26.333", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 1.7, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8770", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-18T19:51:58.409644Z", "version": "2.0.3"}}]}, "published": "2026-05-18T00:16:37.343", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://gist.github.com/YLChen-007/da04e032993a4b2324df915f9ecf9831"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/submit/811428"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/vuln/364395"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/vuln/364395/cti"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/submit/811428"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.14"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.17"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.18"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.19"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.21"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.2.22"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "continue", "source": "cna", "vendor": "continuedev"}, "product": "continue", "vendor": "continuedev"}], "created": "2026-05-18T01:00:06.665414+00:00", "updated": "2026-05-18T10:48:57.606119+00:00", "vendors": ["continuedev", "continuedev$PRODUCT$continue"]}