| शीर्षक | Moonshot AI Kimi Code 0.27.0 Code Injection |
|---|
| विवरण | A vulnerability was identified in Kimi Code up to 0.27.0 (all platforms; confirmed on the 0.27.0 darwin-arm64 release binary). The MCP configuration loader
(agent-core-v2/src/agent/mcp/config-loader.ts) unconditionally merges project-scoped MCP server configuration at session creation with no trust check, and the STDIO connection manager
(connection-manager.ts) immediately spawns each declared server's configured command via StdioClientTransport. The repository-root .mcp.json is resolved by walking up to the nearest .git
directory, so opening any subdirectory of a crafted repository also triggers execution.
As a result, an attacker who commits a .mcp.json file declaring a malicious STDIO MCP server into a repository achieves arbitrary OS command execution with the privileges of any
developer who opens that repository (e.g. via a "please review this project" link or a poisoned template). No trust prompt, approval dialog, allowlist, or signature check is applied.
Execution happens on the pure configuration-load path at session creation (within ~1 second). Verification on 0.27.0 shows the session is created with agent_config.model == "" and zero
token/cost usage: no AI model is invoked, no prompt is sent, no login is required, and no agent activity occurs. This makes it a zero-interaction-on-open RCE with a shorter chain than
the same-class CVE-2026-30615 (Windsurf), which required prompt injection and AI agent action.
Impact: arbitrary command execution with the victim user's privileges; persistence (re-executes on every session opened in the directory); access to SSH keys, cloud credentials, API
tokens and source code.
A non-destructive proof of concept (opens Calculator and writes a local marker file, then completes the MCP initialize/tools/list handshake) is available in the referenced advisory.
This is the trust-boundary gap anticipated in the vendor's public issue #373 and overlaps the .kimi-code/mcp.json auto-execution vector publicly disclosed by @itewqq for versions up to
0.23.0 (no vendor response, no CVE assigned). This report demonstrates the distinct repository-root .mcp.json vector, verified as a complete RCE on the latest 0.27.0 release.
The vendor was notified on 2026-07-20 via email to [email protected] (subject tagged [security], per the vendor's SECURITY.md; the GitHub Security Advisories channel listed as preferred
is not enabled on the repository). No fix is available at the time of writing. Suggested remediation: gate project-scoped MCP servers behind an explicit per-workspace trust prompt
listing each server's full command/args before loading or spawning; persist trust decisions and re-prompt on configuration change.
Same-class CVE precedents: CVE-2026-30615 (Windsurf), CVE-2026-12957 (Amazon Q Developer), CVE-2025-61260 (OpenAI Codex CLI), CVE-2025-59536 (Claude Code), CVE-2025-54135 /
CVE-2025-54136 / CVE-2025-59944 (Cursor). |
|---|
| स्रोत | ⚠️ https://docs.google.com/document/d/1GPDw0UzUkgfXRkWEDqCIanKDq3Tpvllyf08O-0eLyoQ/edit?usp=sharing |
|---|
| उपयोगकर्ता | 38.5 (UID 99979) |
|---|
| सबमिशन | 20/07/2026 08:21 AM (2 महीनों पहले) |
|---|
| संयम | 22/09/2026 02:42 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 408415 [Moonshot AI Kimi Code तक 0.31.0 MCP Configuration Loader config-loader.ts अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|