The vulnerability is in the lsTool function of the JSON‑RPC Server component of continuedev continue. By manipulating the dirPath argument, an attacker who can execute the JSON‑RPC interface locally can traverse directories outside the intended workspace. This path traversal could potentially allow access to files beyond the intended scope, but the CVE description does not explicitly state the extent of the impact. The weakness falls under CWE‑22.

Vulnerable versions of continuedev's continue package are those up to and including 1.2.22. Users running continue 1.2.22 or earlier are affected; newer releases are not enumerated as impacted.

The CVSS score of 4.8 indicates moderate severity, and the vulnerability requires local access, limiting exploitation to users who can reach the machine or the JSON‑RPC endpoint. No EPSS data is available, suggesting the exploit probability is uncertain, and the vulnerability is not listed in the CISA KEV catalog. The exploit is publicly available, which elevates the practical risk for environments where the JSON‑RPC service is exposed to untrusted users.