CVE-2025-11445

MediumCVSS 6.3

Published: 08/10/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

A vulnerability was detected in Kilo Code up to version 4.86.0. It affects the ClineProvider function in src/core/webview/ClineProvider.ts of the Prompt Handler component. Manipulation results in injection, the attack can be initiated remotely, and the exploit is now public and may be used.

Risk Assessment

An injection vulnerability in a publicly available tool may allow a remote attacker to perform unauthorized actions. Since the exploit is public, the risk of exploitation is high.

Recommendation

Apply the available patch to fix the issue. Until updated, restrict access to the Prompt Handler component.

Other vulnerabilities in Kilo Code

CVE-2026-79403High
An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint.

Original NVD description (English source)

A vulnerability was detected in Kilo Code up to 4.86.0. Affected is the function ClineProvider of the file src/core/webview/ClineProvider.ts of the component Prompt Handler. Performing manipulation results in injection. The attack can be initiated remotely. The exploit is now public and may be used. Applying a patch is the recommended action to fix this issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS