This vulnerability involves a path traversal issue in the lsTool function of the core/tools/implementations/lsTool.ts file within the JSON-RPC Server component of continuedev continue versions up to 1.2.22. Manipulating the dirPath argument allows an attacker with local access to traverse directories outside the intended scope. The vulnerability is rated medium severity with a CVSS 4.8 (AV:L/AC:L/PR:L/UI:N). No vendor response or patch is currently available, and the exploit code is publicly accessible.

An attacker with local access and low privileges can exploit this vulnerability to perform path traversal, potentially accessing files and directories outside the intended directory. This could lead to unauthorized information disclosure or manipulation of files accessible to the application user. The impact is limited by the requirement for local access and low privileges, and there is no indication of remote exploitation or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should limit local access to trusted users only and monitor for any updates from the vendor. Avoid running the affected versions in untrusted environments until a patch or official mitigation is released.