CVE-2025-11445 — Kilo Code Prompt ClineProvider.ts ClineProvider injection

Description (CNA)

A vulnerability was detected in Kilo Code up to 4.86.0. Affected is the function ClineProvider of the file src/core/webview/ClineProvider.ts of the component Prompt Handler. Performing manipulation results in injection. The attack can be initiated remotely. The exploit is now public and may be used. Applying a patch is the recommended action to fix this issue.

Affected (CNA)

Vendor / product	Versions
n/a / Kilo Code	affected 4.0; affected 4.1; affected 4.2; affected 4.3; affected 4.4; affected 4.5; affected 4.6; affected 4.7; affected 4.8; affected 4.9; affected 4.10; affected 4.11; affected 4.12; affected 4.13; affected 4.14; affected 4.15; affected 4.16; affected 4.17; affected 4.18; affected 4.19; affected 4.20; affected 4.21; affected 4.22; affected 4.23; affected 4.24; affected 4.25; affected 4.26; affected 4.27; affected 4.28; affected 4.29; affected 4.30; affected 4.31; affected 4.32; affected 4.33; affected 4.34; affected 4.35; affected 4.36; affected 4.37; affected 4.38; affected 4.39; affected 4.40; affected 4.41; affected 4.42; affected 4.43; affected 4.44; affected 4.45; affected 4.46; affected 4.47; affected 4.48; affected 4.49; affected 4.50; affected 4.51; affected 4.52; affected 4.53; affected 4.54; affected 4.55; affected 4.56; affected 4.57; affected 4.58; affected 4.59; affected 4.60; affected 4.61; affected 4.62; affected 4.63; affected 4.64; affected 4.65; affected 4.66; affected 4.67; affected 4.68; affected 4.69; affected 4.70; affected 4.71; affected 4.72; affected 4.73; affected 4.74; affected 4.75; affected 4.76; affected 4.77; affected 4.78; affected 4.79; affected 4.80; affected 4.81; affected 4.82; affected 4.83; affected 4.84; affected 4.85; affected 4.86.0

Vendor / product

Versions

n/a / Kilo Code

affected 4.0; affected 4.1; affected 4.2; affected 4.3; affected 4.4; affected 4.5; affected 4.6; affected 4.7; affected 4.8; affected 4.9; affected 4.10; affected 4.11; affected 4.12; affected 4.13; affected 4.14; affected 4.15; affected 4.16; affected 4.17; affected 4.18; affected 4.19; affected 4.20; affected 4.21; affected 4.22; affected 4.23; affected 4.24; affected 4.25; affected 4.26; affected 4.27; affected 4.28; affected 4.29; affected 4.30; affected 4.31; affected 4.32; affected 4.33; affected 4.34; affected 4.35; affected 4.36; affected 4.37; affected 4.38; affected 4.39; affected 4.40; affected 4.41; affected 4.42; affected 4.43; affected 4.44; affected 4.45; affected 4.46; affected 4.47; affected 4.48; affected 4.49; affected 4.50; affected 4.51; affected 4.52; affected 4.53; affected 4.54; affected 4.55; affected 4.56; affected 4.57; affected 4.58; affected 4.59; affected 4.60; affected 4.61; affected 4.62; affected 4.63; affected 4.64; affected 4.65; affected 4.66; affected 4.67; affected 4.68; affected 4.69; affected 4.70; affected 4.71; affected 4.72; affected 4.73; affected 4.74; affected 4.75; affected 4.76; affected 4.77; affected 4.78; affected 4.79; affected 4.80; affected 4.81; affected 4.82; affected 4.83; affected 4.84; affected 4.85; affected 4.86.0

CWE

CWE-74, CWE-707

References

ADP enrichment

CISA-ADP

No English description supplied.

https://mcpsec.dev/advisories/2025-10-02-kilo-code-ai-agent-supply-chain-attack/