This vulnerability affects the Load function in the Environment Variable Handler of Kilo-Org kilocode (up to version 7.0.47). By manipulating the KILO_CONFIG_CONTENT argument, an attacker can remotely cause information disclosure. The vulnerability has a CVSS 4.0 score of 5.3, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vendor has not provided a fix or advisory, and no patch links are available.

Successful exploitation allows an unauthenticated remote attacker to disclose sensitive information from the affected system by manipulating environment variable content. This could potentially expose configuration or other sensitive data handled by the Environment Variable Handler. There is no indication of privilege escalation, denial of service, or code execution from the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the vulnerable component and monitor for suspicious activity related to environment variable manipulation. Avoid exposing the vulnerable service to untrusted networks until a patch or official mitigation is released.