Description
A vulnerability was detected in Kilo Code up to 4.86.0. Affected is the function ClineProvider of the file src/core/webview/ClineProvider.ts of the component Prompt Handler. Performing manipulation results in injection. The attack can be initiated remotely. The exploit is now public and may be used. Applying a patch is the recommended action to fix this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Kilo Code | 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.16, 4.17, 4.18, 4.19, 4.20, 4.21, 4.22, 4.23, 4.24, 4.25, 4.26, 4.27, 4.28, 4.29, 4.30, 4.31, 4.32, 4.33, 4.34, 4.35, 4.36, 4.37, 4.38, 4.39, 4.40, 4.41, 4.42, 4.43, 4.44, 4.45, 4.46, 4.47, 4.48, 4.49, 4.50, 4.5… | — |
References
- VDB-327382 | Kilo Code Prompt ClineProvider.ts ClineProvider injection vdb-entry technical-description
- VDB-327382 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #667004 | Kilo Code Kilo Code VS Code Extension 4.86.0 Insecure Permissions third-party-advisory
- https://mcpsec.dev/advisories/2025-10-02-kilo-code-ai-agent-supply-chain-attack/ exploit
- https://github.com/Kilo-Org/kilocode/pull/2244 issue-tracking
- https://github.com/Kilo-Org/kilocode/pull/2244/commits/2fdddf89edba41ec3a527134e485a3388c464333 issue-tracking patch