Description
A vulnerability was detected in Moonshot AI Kimi Code up to 2.0.2. This vulnerability affects unknown code of the file .kimi-code/local.toml of the component WorkspaceDirsService. Performing a manipulation of the argument additional_dir results in reliance on untrusted inputs in a security decision. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.1.0 is able to resolve this issue. Upgrading the affected component is recommended.
Published: 2026-11-11
Score: 4.8 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Nov 2026 23:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in Moonshot AI Kimi Code up to 2.0.2. This vulnerability affects unknown code of the file .kimi-code/local.toml of the component WorkspaceDirsService. Performing a manipulation of the argument additional_dir results in reliance on untrusted inputs in a security decision. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.1.0 is able to resolve this issue. Upgrading the affected component is recommended.
Title Moonshot AI Kimi Code WorkspaceDirsService local.toml reliance on untrusted inputs in a security decision
First Time appeared Moonshot Ai
Moonshot Ai kimi Code
Weaknesses CWE-20
CWE-807
CPEs cpe:2.3:a:moonshot_ai:kimi_code:*:*:*:*:*:*:*:*
Vendors & Products Moonshot Ai
Moonshot Ai kimi Code
References
Metrics cvssV2_0

{'score': 3.2, 'vector': 'AV:L/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 4.4, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Moonshot Ai Kimi Code
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-11T23:00:47.831Z

Reserved: 2026-11-11T16:58:32.820Z

Link: CVE-2026-126758

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-11T23:17:11.320

Modified: 2026-11-11T23:17:11.500

Link: CVE-2026-126758

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-807

    Reliance on Untrusted Inputs in a Security Decision