Liteide EUVD-2026-14701

Without an assigned CVSS score or EPSS probability data, risk assessment relies on the available signals: CWE-444 (HTTP Request Smuggling) is historically a high-impact vulnerability class with real-world exploitation precedent. The vulnerability affects a development/IDE tool (liteide) rather than a widely-exposed internet-facing service, which reduces the attack surface compared to web servers or proxies. However, if liteide instances are used in collaborative environments or expose HTTP services (qjsonrpc), the risk escalates. The availability of a vendor patch (GitHub PR #1325) indicates the vendor has acknowledged and addressed the issue. No KEV (Known Exploited Vulnerability) status is reported, and no public POC is evident from the provided data, suggesting this may be pre-disclosure or low in active exploitation. For organizations using liteide versions before x38.4 in networked or server-like contexts, this represents a moderate-to-high priority based on CWE severity and the nature of HTTP smuggling attacks, but lower urgency if liteide is used only as a local IDE.

An attacker with network access to a liteide instance or its HTTP services (qjsonrpc) could craft a specially-formed HTTP request with ambiguous Content-Length or Transfer-Encoding headers that the liteide parser interprets differently than downstream proxies or servers. By exploiting this discrepancy, the attacker could smuggle additional HTTP requests within a single connection, potentially poisoning cached responses, hijacking sessions of other users, or causing liteide to perform unintended actions. Given liteide's typical deployment as a local IDE, this scenario is most realistic in collaborative or remote development environments where multiple clients connect to a shared liteide service or IDE server.