CVE-2026-95660 in Kimi Code
Summary
by MITRE • 09/22/2026
A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.31.1 is sufficient to fix this issue. It is recommended to upgrade the affected component. Beyond the trust prompt, the fix resolves fd/stty binaries to absolute paths specifically "so untrusted workspaces cannot plant bare-name executables before confirmation," fixing a secondary $PATH path-planting vector alongside the primary untrusted-.mcp.json auto-spawn.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
A critical security vulnerability has been identified in Moonshot AI Kimi Code, affecting versions up to 0.31.0 within the MCP Configuration Loader component. The flaw resides specifically in an unknown function located at agent-core-v2/src/agent/mcp/config-loader.ts and manifests as a remote operating system command injection issue. This type of vulnerability allows attackers to execute arbitrary commands on the host system with the privileges of the application, posing a severe risk to data integrity and confidentiality. The existence of publicly released exploits indicates that this weakness is actively being leveraged in real-world attacks, necessitating immediate remediation by all users running affected versions.
The technical root cause involves improper neutralization of special elements used in operating system commands, commonly categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command. In the context of this vulnerability, the configuration loader fails to adequately sanitize or validate inputs before passing them to shell interpreters for execution. This oversight enables malicious actors to inject additional command sequences that are executed by the underlying operating system rather than being treated as literal data. The ability to launch such attacks remotely significantly lowers the barrier for exploitation, allowing adversaries who can interact with the application's configuration interface to gain unauthorized control over the environment without requiring local access or user interaction beyond initial connection.
The operational impact of this command injection is profound, potentially leading to complete system compromise. An attacker could use this vector to exfiltrate sensitive data, install backdoors, pivot to other systems within a network, or disrupt service availability by terminating critical processes. The vulnerability highlights the dangers associated with dynamically loading and executing external configurations in security-sensitive applications like AI coding assistants, which often require broad filesystem access and execution capabilities to function effectively. The presence of public exploits amplifies the urgency, as automated scanning tools can easily detect and exploit this weakness across vulnerable deployments globally.
The resolution implemented in version 0.31.1 addresses both the primary command injection vector related to untrusted .mcp.json auto-spawning and a secondary path-planting vulnerability. The fix resolves file descriptors and standard terminal binaries, such as stty, to their absolute paths rather than relying on relative names or environment variables that could be manipulated. This change specifically mitigates $PATH manipulation attacks where an attacker might plant malicious executables with common binary names in directories preceding the legitimate system paths. By enforcing absolute path resolution, the application ensures it invokes only trusted binaries from known locations, thereby neutralizing the ability of untrusted workspaces to hijack execution flow through environment variable abuse or directory traversal techniques.
From a defensive perspective, this incident underscores the importance of adhering to secure coding practices outlined in standards such as CWE-78 and MITRE ATT&CK technique T1059 Command and Scripting Interpreter. Developers must ensure that any input used in system command construction is strictly validated against an allowlist or passed directly to safe API functions rather than shell interpreters. For organizations utilizing Kimi Code, upgrading to version 0.31.1 is the definitive mitigation strategy. Additionally, implementing network-level controls such as web application firewalls and strict egress filtering can provide layered defense by limiting the impact of successful exploitation attempts on broader infrastructure security posture.