Low
continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal
Type: advisorySources: OSV
A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-8770
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 8 Nov 2026, 02:34 UTC · Revision 1
Source evidence
continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal
core-osv · Original sourcePublished 17 May 2026, 23:15 UTC
A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
osv:CVE-2026-8770
Complete source record
{
"id": "80694ab5008f02d6050c03c7bf1b1d8cf0194ae85f8ed243fc90e738b40ea37b",
"url": "https://osv.dev/vulnerability/CVE-2026-8770",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal",
"summary": "A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"evidence": "osv:CVE-2026-8770",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2026-8770",
"aliases": [
"CVE-2026-8770"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/continuedev/continue",
"type": "GIT",
"events": [
{
"introduced": "c75c082289505c7ac5bb347d2c12ae64fc6be19e"
},
{
"last_affected": "5607a67ae46e2e1edcf54c44fca81ea75c27b372"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:continue:continue:*:*:*:*:*:visual_studio_code:*:*",
"range": [
{
"introduced": "1.2.0"
},
{
"last_affected": "1.2.22"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8770.json"
}
}
],
"modified": "2026-10-28T02:30:52.830580270Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8770.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-8770",
"https://vuldb.com/submit/811428",
"https://vuldb.com/vuln/364395",
"https://vuldb.com/vuln/364395/cti",
"https://gist.github.com/YLChen-007/da04e032993a4b2324df915f9ecf9831"
],
"provider_metadata": {
"cwe_ids": [
"CWE-22"
],
"cna_assigner": "VulDB",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"introduced": "1.2.0"
},
{
"last_affected": "1.2.0"
},
{
"introduced": "1.2.1"
},
{
"last_affected": "1.2.1"
},
{
"introduced": "1.2.2"
},
{
"last_affected": "1.2.2"
},
{
"introduced": "1.2.3"
},
{
"last_affected": "1.2.3"
},
{
"introduced": "1.2.4"
},
{
"last_affected": "1.2.4"
},
{
"introduced": "1.2.5"
},
{
"last_affected": "1.2.5"
},
{
"introduced": "1.2.6"
},
{
"last_affected": "1.2.6"
},
{
"introduced": "1.2.7"
},
{
"last_affected": "1.2.7"
},
{
"introduced": "1.2.8"
},
{
"last_affected": "1.2.8"
},
{
"introduced": "1.2.9"
},
{
"last_affected": "1.2.9"
},
{
"introduced": "1.2.10"
},
{
"last_affected": "1.2.10"
},
{
"introduced": "1.2.11"
},
{
"last_affected": "1.2.11"
},
{
"introduced": "1.2.12"
},
{
"last_affected": "1.2.12"
},
{
"introduced": "1.2.13"
},
{
"last_affected": "1.2.13"
},
{
"introduced": "1.2.14"
},
{
"last_affected": "1.2.14"
},
{
"introduced": "1.2.15"
},
{
"last_affected": "1.2.15"
},
{
"introduced": "1.2.16"
},
{
"last_affected": "1.2.16"
},
{
"introduced": "1.2.17"
},
{
"last_affected": "1.2.17"
},
{
"introduced": "1.2.18"
},
{
"last_affected": "1.2.18"
},
{
"introduced": "1.2.19"
},
{
"last_affected": "1.2.19"
},
{
"introduced": "1.2.20"
},
{
"last_affected": "1.2.20"
},
{
"introduced": "1.2.21"
},
{
"last_affected": "1.2.21"
},
{
"introduced": "1.2.22"
},
{
"last_affected": "1.2.22"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandaloneSingleVersion"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8770.json"
}
},
"related_cves": [
{
"value": "CVE-2026-8770",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 521828,
"published_at": "2026-05-17T23:15:15.257+00:00"
}