CVE-2026-30306 describes a critical prompt injection vulnerability in SakaDev's automatic terminal command execution feature, allowing attackers to bypass safety mechanisms and execute arbitrary commands. This flaw, affecting SakaDev products, carries a CVSS score of 9.8 (Critical) due to its network-based, low-complexity exploitation leading to full compromise of confidentiality, integrity, and availability. While not currently listed in CISA KEV and lacking public exploit code or significant community discussion, its inclusion on the Hot List signifies it as a high-priority concern.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.0.6CPE matchmatch criteria | cpe:2.3:a:rahmanazhar:sakadev:*:*:*:*:*:visual_studio_code:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.