CVE-2026-30302 is a critical OS Command Injection vulnerability found in the command auto-approval module of CodeRider-Kilo and coderider products. This flaw allows attackers to bypass whitelist security mechanisms due to an incompatible command parser and mishandling of Windows CMD escape sequences, enabling the execution of arbitrary commands. Rated 10.0 Critical with a network attack vector and low complexity, it permits unauthenticated attackers to achieve Remote Code Execution (RCE) with full impact on confidentiality, integrity, and availability. While there is no public exploit code available (Metasploit, Nuclei, ExploitDB) and it is not currently on CISA's KEV or Hot List, the vulnerability has garnered some community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.3.6CPE matchmatch criteria | cpe:2.3:a:coderider-kilo:coderider:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.