CVE-2026-8770 Overview
CVE-2026-8770 is a path traversal vulnerability affecting Continue, an open-source AI coding assistant for Visual Studio Code. The flaw resides in the lsTool function within core/tools/implementations/lsTool.ts, part of the JSON-RPC Server component. An authenticated local attacker can manipulate the dirPath argument to traverse directories outside the intended scope [CWE-22]. The vulnerability affects Continue versions up to and including 1.2.22. A public proof-of-concept exists, and the vendor did not respond to disclosure attempts.
Critical Impact
Local attackers with low privileges can enumerate files outside the authorized workspace directory by submitting crafted directory paths to the lsTool JSON-RPC handler.
Affected Products
- Continue extension for Visual Studio Code, versions up to 1.2.22
- core/tools/implementations/lsTool.ts module
- JSON-RPC Server component within Continue
Discovery Timeline
- 2026-05-18 - CVE-2026-8770 published to NVD
- 2026-05-19 - Last updated in NVD database
Technical Details for CVE-2026-8770
Vulnerability Analysis
The vulnerability exists in the lsTool implementation, which exposes a directory listing capability over the Continue JSON-RPC Server interface. The handler accepts a dirPath argument from clients and passes it to file system operations without adequately validating that the resolved path remains within the intended workspace boundary.
Because the input is not normalized or constrained, an attacker can supply traversal sequences such as ../ to escape the workspace root. The handler then enumerates arbitrary directories on the host file system accessible to the user running the extension. Exploitation requires local access and low privileges, consistent with a developer workstation context where the Continue extension runs inside Visual Studio Code.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The lsTool function in core/tools/implementations/lsTool.ts does not canonicalize the supplied dirPath or verify that the resolved absolute path is a descendant of an allow-listed root. This omission permits traversal to sibling or parent directories outside the workspace.
Attack Vector
The attack vector is local. An attacker with low-privilege access to the system, or a malicious component capable of issuing JSON-RPC requests to the Continue server, sends a crafted request invoking lsTool with a dirPath value containing traversal sequences. The server responds with directory listings from arbitrary paths, exposing file and directory names outside the workspace. Confidentiality impact is limited; the vulnerability does not directly enable file modification or denial of service. A public proof-of-concept describing the exploitation steps is referenced in the GitHub Gist PoC.
Detection Methods for CVE-2026-8770
Indicators of Compromise
- JSON-RPC requests to the Continue server containing lsTool invocations with dirPath values that include ../, ..\, or absolute paths outside the workspace root.
- Unexpected file system enumeration activity originating from the Continue extension host process.
- Continue process accessing directories such as /etc, user home directories outside the project, or system configuration paths.
Detection Strategies
- Inspect Continue server request logs for lsTool calls referencing traversal sequences or absolute paths outside known project directories.
- Apply file system auditing on developer endpoints to flag directory enumeration by the Visual Studio Code or Continue extension host process against sensitive paths.
- Correlate process telemetry from the Visual Studio Code extension host with file open and readdir system calls targeting paths outside active workspaces.
Monitoring Recommendations
- Enable verbose logging in the Continue extension to capture tool invocation arguments for forensic review.
- Monitor for newly installed or updated Continue extensions on developer workstations and confirm the version is patched.
- Track outbound JSON-RPC traffic to local Continue server endpoints from unexpected client processes.
How to Mitigate CVE-2026-8770
Immediate Actions Required
- Identify all developer workstations running Continue versions at or below 1.2.22 and prioritize upgrade once a fixed release is published.
- Restrict use of the Continue extension on systems handling sensitive source code or credentials until a patched version is available.
- Review Continue server logs for prior lsTool invocations with traversal patterns to assess potential exposure.
Patch Information
At the time of publication, no vendor advisory or fixed version is referenced in the available CVE data. The vendor did not respond to the disclosure. Track the VulDB Vulnerability #364395 entry and the upstream Continue repository for a security release that constrains dirPath to the workspace root.
Workarounds
- Disable or uninstall the Continue extension on workstations where untrusted local users or processes could issue JSON-RPC requests.
- Run Visual Studio Code under a least-privilege user account to limit the files reachable through any traversal.
- Apply operating system file permissions and mandatory access controls to deny the developer account read access to sensitive directories outside project workspaces.
# Verify installed Continue extension version and remove if vulnerable
code --list-extensions --show-versions | grep -i continue
code --uninstall-extension continue.continue
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
