Threats affecting pkg:github/continuedev/continue

CVE-2026-8770 is a medium severity path traversal vulnerability in continuedev continue versions up to 1.2.22. It affects the lsTool function in the JSON-RPC Server component, allowing local attackers with low privileges to manipulate the dirPath argument to perform path traversal. The vulnerability requires local access and does not involve user interaction. The vendor has not responded to disclosure requests, and no official patch or remediation guidance is currently available. Exploit code is publicly available, but no known exploitation in the wild has been reported.