CVE-2025-11445
A vulnerability was detected in Kilo Code up to 4.86.0. Affected is the function ClineProvider of the file src/core/webview/ClineProvider.ts of the component Prompt Handler. Performing manipulation results in injection. The attack can be initiated remotely. The exploit is now public and may be used. Applying a patch is the recommended action to fix this issue.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 7.5
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 0.32%
- CWE
- CWE-74, CWE-707
- Published
- 2025-10-08
- Last modified
- 2026-03-12
Affected products
- n/a Kilo Code
- n/a Kilo Code
- n/a Kilo Code
- n/a Kilo Code
- n/a Kilo Code
- n/a Kilo Code
- n/a Kilo Code
- n/a Kilo Code
Weakness type
Related vulnerabilities
- CVE-2026-87572 — Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had...
- CVE-2026-86675 — itsourcecode Sales and Inventory System us_edit.php sql injection
- CVE-2026-65669 — Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2026-86667 — aircheng-org iWebShop-5 member.php member_list sql injection
- CVE-2026-86518 — code-projects Student Crud Operation edit.php sql injection
- CVE-2026-86517 — itsourcecode Sales and Inventory System us_searchfrm.php mysqli_query sql injection
- CVE-2026-86310 — itsourcecode Sales and Inventory System cust_edit1.php sql injection
- CVE-2026-86309 — itsourcecode Sales and Inventory System pro_searchfrm.php sql injection