CVE-2026-8770: continuedev continue JSON-RPC Server lsTool.ts lsTool path traversal
A vulnerability was identified in continuedev continue up to 1.2.22. This affects the function lsTool of the file core/tools/implementations/lsTool.ts of the component JSON-RPC Server. Such manipulation of the argument dirPath leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
continuedev continue JSON-RPC Serverfrom your environment.Uninstall or remove the JSON-RPC Server component if it is not required to eliminate the vulnerable lsTool implementation.
- Configuration
Disable or stop the JSON-RPC Server if it is not required (set enabled=false or stop the service) to prevent local attackers from invoking the vulnerable lsTool endpoint.
continuedev continue JSON-RPC Server enabled = false - Compensating control
Restrict local access to hosts running the JSON-RPC Server: limit local user accounts and privileges, apply local firewalls/ACLs, container/isolation boundaries, and other OS-level controls so untrusted local users cannot invoke the vulnerable lsTool (the exploit requires local access).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8770?
CVE-2026-8770 has been classified as a medium severity vulnerability due to its potential for path traversal attacks.
How do I fix CVE-2026-8770?
To fix CVE-2026-8770, update the continuedev continue software to version 1.2.23 or later.
What impact does CVE-2026-8770 have on affected systems?
CVE-2026-8770 allows an attacker to manipulate the dirPath argument, potentially accessing unauthorized files on the server.
Which versions of continuedev continue are affected by CVE-2026-8770?
CVE-2026-8770 affects all versions of continuedev continue up to and including version 1.2.22.
Does CVE-2026-8770 affect other components apart from lsTool.ts?
CVE-2026-8770 specifically impacts the lsTool function within the core/tools/implementations/lsTool.ts file in the JSON-RPC Server component.