CVE-2026-30302: Coderider-Kilo Coderider RCE Vulnerability

CVE-2026-30302 Overview

CVE-2026-30302 is an OS Command Injection vulnerability [CWE-78] in the command auto-approval module of CodeRider-Kilo. The flaw renders the product's whitelist security mechanism ineffective on Windows hosts. CodeRider-Kilo uses the Unix-oriented shell-quote library to parse commands before approval, but the runtime executes them through the Windows CMD interpreter. Attackers exploit this parser/executor mismatch to inject arbitrary commands behind a seemingly valid git invocation. Successful exploitation yields arbitrary Remote Code Execution (RCE) on the host running CodeRider-Kilo.

Critical Impact

A network-reachable attacker can bypass the Git command whitelist and execute arbitrary OS commands on Windows systems running CodeRider-Kilo, with no authentication or user interaction required.

Affected Products

• CodeRider-Kilo (coderider-kilo:coderider) — all versions matching the published CPE
• Windows platforms where CodeRider-Kilo invokes commands via CMD
• Deployments relying on the command auto-approval whitelist for safety

Discovery Timeline

• 2026-03-27 - CVE-2026-30302 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-30302

Vulnerability Analysis

The auto-approval module is designed to whitelist read-only Git commands such as git log and git status before they are dispatched to the operating system. To enforce the whitelist, CodeRider-Kilo tokenizes the incoming command string with the shell-quote Node.js library, which implements POSIX shell quoting rules. The parser determines whether each token is a literal argument or a shell metacharacter, and approves the command only when no unsafe operators appear outside of quoted strings.

The problem is environmental. On Windows, the executed command is handed to cmd.exe, whose quoting and escaping rules differ from POSIX shells. The two layers disagree on what constitutes a string boundary, and that disagreement is the entire attack surface.

Root Cause

The root cause is the use of an incompatible command parser for the target execution environment, combined with missing handling of the Windows CMD caret (^) escape character. shell-quote treats ^" as part of a quoted literal, while cmd.exe interprets ^ as an escape that neutralizes the following ". The result is a classic parser differential vulnerability: the security check and the execution engine read the same input differently.

Attack Vector

An attacker crafts a payload such as git log ^" & malicious_command ^". The shell-quote parser sees the & as residing inside a quoted string argument to git log, so the command matches the Git whitelist and is auto-approved. When CMD executes the string, it discards the caret-escaped quotes, treats & as a command separator, and runs malicious_command with the privileges of the CodeRider-Kilo process. Additional connectors such as &&, |, and || can be smuggled through the same caret-escape trick, enabling arbitrary command chains.

No authenticated session is required when CodeRider-Kilo accepts commands over a network-exposed interface, which aligns with the network attack vector indicated for this issue.

Detection Methods for CVE-2026-30302

Indicators of Compromise

• Process creation events where cmd.exe is spawned by the CodeRider-Kilo process with command lines containing ^" or stray carets adjacent to quotes.
• Child processes of CodeRider-Kilo that are not git.exe, especially powershell.exe, cmd.exe, wscript.exe, cscript.exe, rundll32.exe, or certutil.exe.
• Outbound network connections from CodeRider-Kilo child processes to attacker-controlled hosts shortly after a git command is logged.
• Audit log entries showing whitelist-approved git commands that contain &, |, or ; outside of normal Git syntax.

Detection Strategies

• Hunt for command-line patterns matching the regex git\s+\w+.*\^" in endpoint telemetry and CodeRider-Kilo audit logs.
• Alert on any process tree where CodeRider-Kilo is the ancestor of a non-git binary, treating this as a high-fidelity indicator of injection.
• Correlate auto-approval log entries with subsequent process creation events to identify mismatches between the approved command and what actually ran.

Monitoring Recommendations

• Forward Windows Sysmon Event ID 1 (process creation) and CodeRider-Kilo application logs to a centralized data lake for correlation.
• Baseline the expected set of binaries spawned by CodeRider-Kilo and alert on deviations.
• Monitor for new outbound network destinations originating from hosts running CodeRider-Kilo.

How to Mitigate CVE-2026-30302

Immediate Actions Required

• Restrict CodeRider-Kilo to trusted operators only and remove any network exposure of its command interface until a fix is applied.
• Run CodeRider-Kilo under a low-privilege Windows service account that cannot modify system files or pivot to other hosts.
• Disable or bypass the command auto-approval feature on Windows and require explicit human approval for every command.
• Review CodeRider-Kilo audit logs for the historical presence of caret-escape payloads in approved commands.

Patch Information

At the time of publication, no vendor advisory or patched release is listed in the NVD entry for CVE-2026-30302. Track the upstream project for updates and review the GitHub Issue Discussion for ongoing remediation status. Once a fix is published, the auto-approval module should validate commands using a parser aligned with the actual execution shell, or invoke commands without going through cmd.exe at all (for example, by spawning git.exe directly with an argument array).

Workarounds

• Force CodeRider-Kilo to execute commands through a process API that takes an argument array rather than a shell string, eliminating CMD interpretation entirely.
• Apply an allowlist that rejects any command string containing the ^ character before it reaches the parser.
• Wrap the CodeRider-Kilo service with Windows AppLocker or Windows Defender Application Control rules that permit only git.exe as a child process.
• Deploy host-based egress filtering so that even a successful injection cannot reach attacker infrastructure.

# Example AppLocker-style restriction concept (pseudo-config)
# Allow only git.exe as a child of the CodeRider-Kilo service account
ParentProcess: coderider-kilo.exe
AllowedChildren:
  - C:\Program Files\Git\cmd\git.exe
DenyAll: true