CVE-2025-11445: falha de média gravidade em Kilo Code
Kilo Code Prompt ClineProvider.ts ClineProvider injection
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
A vulnerability was detected in Kilo Code up to 4.86.0. Affected is the function ClineProvider of the file src/core/webview/ClineProvider.ts of the component Prompt Handler. Performing manipulation results in injection. The attack can be initiated remotely. The exploit is now public and may be used. Applying a patch is the recommended action to fix this issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
n/a · Kilo CodeReferências
https://github.com/Kilo-Org/kilocode/pull/2244https://github.com/Kilo-Org/kilocode/pull/2244/commits/2fdddf89edba41ec3a527134e485a3388c464333https://mcpsec.dev/advisories/2025-10-02-kilo-code-ai-agent-supply-chain-attack/https://vuldb.com/?ctiid.327382https://vuldb.com/?id.327382https://vuldb.com/?submit.667004