Read the docs
TI-2026-63668 Aliases CVE-2026-95660GHSA-jp7p-97jq-v89h

Moonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injection

Priority MEDIUM 57CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.31.1 is sufficient to fix this issue. It is recommended to upgrade the affected component. Beyond the trust prompt, the fix resolves fd/stty binaries to absolute paths specifically "so untrusted workspaces cannot plant bare-name executables before confirmation," fixing a secondary $PATH path-planting vector alongside the primary untrusted-.mcp.json auto-spawn.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01665 76th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Kimi Code (Moonshot AI): 0.31.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MoonshotAIKimi Code0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9; 0.10; 0.11; 0.12; 0.13; 0.14; 0.15; 0.16; 0.17; 0.18; 0.19; 0.20; 0.21; 0.22; 0.23; 0.24; 0.25; 0.26; 0.27; 0.28; 0.29; 0.30; 0.31.00.31.1Patch availableCNA
  • Kimi Code VendorMoonshotAI Affected 0.1; 0.2; 0.3; 0.4; 0.5; 0.6; 0.7; 0.8; 0.9; 0.10; 0.11; 0.12; 0.13; 0.14; 0.15; 0.16; 0.17; 0.18; 0.19; 0.20; 0.21; 0.22; 0.23; 0.24; 0.25; 0.26; 0.27; 0.28; 0.29; 0.30; 0.31.0 Fixed in 0.31.1 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:moonshot_ai:kimi_code:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:moonshot_ai:kimi_code:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA Kimi Code (Moonshot AI) Fixed in 0.31.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-95660
  2. 2026-10-03 Alias added: GHSA-jp7p-97jq-v89h

References

Exploit 1

Patch 1

  • TI-2026-14384 Kimi Code FetchURL SSRF protection bypass via DNS-resolving hostnames and redirects CVSS 3.1MEDIUM 5.5
  • TI-2026-20230 [Kimi VS Code] Command Injection in publish scripts vsix-publish.js and ovsx-publish.js CVSS 3.1LOW 2.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences