This vulnerability exists in the lsTool function of the core/tools/implementations/lsTool.ts file within the JSON-RPC Server component of continuedev continue up to version 1.2.22. By manipulating the dirPath argument, a local attacker with low privileges can perform path traversal, potentially accessing files outside the intended directory scope. The attack vector is local, requiring the attacker to have some level of access to the system. The CVSS 4.0 base score is 4.8, reflecting medium severity with low attack complexity and no user interaction required. No official patch or remediation level has been provided by the vendor, who has not responded to early disclosure attempts.

The vulnerability allows a local attacker with low privileges to perform path traversal via the dirPath argument to the lsTool function, potentially accessing unauthorized files on the system. Since the attack is local and requires some privileges, the impact is limited to scenarios where an attacker already has access to the host. There is no indication of remote exploitation or privilege escalation from the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should restrict local access to trusted users only and monitor for any suspicious local activity involving the lsTool function. Avoid running the affected versions in untrusted environments until a patch or official guidance is released.