Kilo Code EUVD-2026-89423

Requires the Kilo Code CLI daemon/TUI HTTP server to be running on the target host AND the attacker to have local access to its loopback listener (another local user account, a malicious local process/dependency, or a browser/tool able to reach the localhost port). Pre-fix, the daemon used a hardcoded default password ('kilo') and the /permission/allow-everything route performed no auth check, so no credentials were needed. Exploitation is LIMITED to versions before v7.4.1 and to environments where an attacker already has some local code-execution or network reach to the local service - it is not remotely exploitable across the network and needs no user interaction once local reach is obtained.

This is a genuine but access-gated code-execution flaw, not an internet-facing crisis. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.4 HIGH) is internally consistent with the source evidence: the vulnerable /permission/allow-everything HTTP route is bound locally and, before the fix, accepted unauthenticated callers (PR:N) - but AV:L means an attacker must already have local presence (a logged-in user, a malicious local process, or a hostile website/tool able to reach the localhost daemon port). The SSVC framework corroborates a low-urgency posture: Exploitation=none (no observed exploitation), Automatable=no, Technical Impact=total - i.e. high impact per exploit but not mass-exploitable. No EPSS score, no CISA KEV listing, and no vendor-claimed active exploitation are present in the input, so there is 'no public exploit identified' in the structured feeds - however a proof-of-concept gist (akinerkisa) IS referenced alongside the fixing PR/commit, so working exploitation detail is effectively public even though it is not tracked as a formal POC flag. Net: prioritize for anyone running Kilo Code CLI on multi-user or untrusted-local-code hosts, but the local-only vector sharply limits blast radius versus the raw 8.4 score.

On a host where the Kilo Code CLI daemon is running, a local attacker - a low-privileged user account, a malicious dependency/build script, or a web page exploiting the localhost HTTP listener - sends a request to the unauthenticated /permission/allow-everything endpoint to disable all permission prompts, then drives the agent to run arbitrary shell commands with the victim's privileges. A proof-of-concept gist is publicly referenced, and the daemon's hardcoded default password ('kilo') made the pre-fix listener trivially reachable.