Skip to content
CVE PROGRAM SOURCE RECORD4.8 Medium

CVE-2026-126758

Moonshot AI Kimi Code WorkspaceDirsService local.toml reliance on untrusted inputs in a security decision

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulDB

Description

A vulnerability was detected in Moonshot AI Kimi Code up to 2.0.2. This vulnerability affects unknown code of the file .kimi-code/local.toml of the component WorkspaceDirsService. Performing a manipulation of the argument additional_dir results in reliance on untrusted inputs in a security decision. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.1.0 is able to resolve this issue. Upgrading the affected component is recommended.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Moonshot AI Kimi Code

  • 2.0.0affected
  • 2.0.1affected
  • 2.0.2affected
  • 2.1.0unaffected

References