| शीर्षक | Kilo Code Kilo Code VS Code Extension 4.86.0 Insecure Permissions |
|---|
| विवरण | The Kilo Code agent VS Code Extension fails to prevent writes outside of the working directory. This allows for the editing of the `settings.json` file. Through an indirect prompt injection, an attacker can set a user up to have the Kilo Code agent a) modify the settings.json file to whitelist previously unwhitelisted commands b) poison the supply chain via git invocations.
The user falls into this issue when attempting to interact with some untrusted data source, such as a compromised project, or a GitHub issue. |
|---|
| स्रोत | ⚠️ https://mcpsec.dev/advisories/2025-10-02-kilo-code-ai-agent-supply-chain-attack/ |
|---|
| उपयोगकर्ता | echarris128 (UID 91221) |
|---|
| सबमिशन | 02/10/2025 12:55 AM (1 वर्ष पहले) |
|---|
| संयम | 07/10/2025 03:30 PM (6 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 327382 [Kilo Code तक 4.86.0 Prompt ClineProvider.ts ClineProvider अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|