MoonshotAI

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

MoonshotAI records in CISA KEV

No MoonshotAI vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-63668 CVE-2026-95660 · GHSA-jp7p-97jq-v89h

Moonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injection

MEDIUM 57

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.01665 Published 2026-09-22 Fixed in 0.31.1 CWE-77

TI-2026-14384 CVE-2026-17534 · GHSA-28vq-345c-25gg

Kimi Code FetchURL SSRF protection bypass via DNS-resolving hostnames and redirects

LOW 24

Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects…

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00158 Published 2026-07-27 Fixed in 0.27.0 CWE-918

TI-2026-20230 CVE-2026-25046

[Kimi VS Code] Command Injection in publish scripts vsix-publish.js and ovsx-publish.js

LOW 13

Kimi Agent SDK is a set of libraries that expose the Kimi Code (Kimi CLI) agent runtime in applications.

CVSS 3.1LOW 2.9 Local High privileges User interaction EPSS 0.00135 Published 2026-01-29 Fixed in 0.1.6 CWE-77

Open these records in search →

Critical	0
High	0
Medium	2
Low	1
No CVSS	0