Executive brief
Kite is an AI-powered coding assistant used by developers to automate code completion. A security flaw in its Windows service allows a person with limited access to a computer to gain full administrative control (LocalSystem privileges). This could allow an attacker to bypass security restrictions, access sensitive data, or install persistent malware on the affected workstation.
Technical details
The KiteService Windows service in Kite version 4.2.0.1 U1 (and potentially earlier) is configured with an unquoted executable path containing spaces (C:\Program Files\Kite\KiteService.exe). This CWE-428 vulnerability allows a local attacker with write permissions to the parent directories to place a malicious executable (e.g., C:\Program.exe) that Windows will execute instead of the intended service binary. Because the service is configured to run as LocalSystem, the attacker's code will execute with the highest possible privileges on the host. The vendor has ceased operations and discontinued support for the software, meaning a formal patch is unlikely to be released; users should consider manually quoting the service path or uninstalling the application.
Affected products
- Kite Kite 4.2.0.1 U1 and earlier
Timeline
- 2020-11-06: other: Vulnerability discovered by researcher
- 2021-11-16: other: Vendor (Kite) announced they were ceasing operations and support
- 2022-07-21: disclosed: Exploit published on Exploit-DB
- 2026-05-16: advisory: CVE published and NVD record created