Отправить #897071: Moonshot AI Kimi Code 0.27.0 Code Injection

A vulnerability was identified in Kimi Code up to 0.27.0 (all platforms; confirmed on the 0.27.0 darwin-arm64 release binary). The MCP configuration loader
(agent-core-v2/src/agent/mcp/config-loader.ts) unconditionally merges project-scoped MCP server configuration at session creation with no trust check, and the STDIO connection manager
(connection-manager.ts) immediately spawns each declared server's configured command via StdioClientTransport. The repository-root .mcp.json is resolved by walking up to the nearest .git
directory, so opening any subdirectory of a crafted repository also triggers execution.

As a result, an attacker who commits a .mcp.json file declaring a malicious STDIO MCP server into a repository achieves arbitrary OS command execution with the privileges of any
developer who opens that repository (e.g. via a "please review this project" link or a poisoned template). No trust prompt, approval dialog, allowlist, or signature check is applied.

Execution happens on the pure configuration-load path at session creation (within ~1 second). Verification on 0.27.0 shows the session is created with agent_config.model == "" and zero
token/cost usage: no AI model is invoked, no prompt is sent, no login is required, and no agent activity occurs. This makes it a zero-interaction-on-open RCE with a shorter chain than
the same-class CVE-2026-30615 (Windsurf), which required prompt injection and AI agent action.

Impact: arbitrary command execution with the victim user's privileges; persistence (re-executes on every session opened in the directory); access to SSH keys, cloud credentials, API
tokens and source code.

A non-destructive proof of concept (opens Calculator and writes a local marker file, then completes the MCP initialize/tools/list handshake) is available in the referenced advisory.

This is the trust-boundary gap anticipated in the vendor's public issue #373 and overlaps the .kimi-code/mcp.json auto-execution vector publicly disclosed by @itewqq for versions up to
0.23.0 (no vendor response, no CVE assigned). This report demonstrates the distinct repository-root .mcp.json vector, verified as a complete RCE on the latest 0.27.0 release.

The vendor was notified on 2026-07-20 via email to [email protected] (subject tagged [security], per the vendor's SECURITY.md; the GitHub Security Advisories channel listed as preferred
is not enabled on the repository). No fix is available at the time of writing. Suggested remediation: gate project-scoped MCP servers behind an explicit per-workspace trust prompt
listing each server's full command/args before loading or spawning; persist trust decisions and re-prompt on configuration change.

Same-class CVE precedents: CVE-2026-30615 (Windsurf), CVE-2026-12957 (Amazon Q Developer), CVE-2025-61260 (OpenAI Codex CLI), CVE-2025-59536 (Claude Code), CVE-2025-54135 /
CVE-2025-54136 / CVE-2025-59944 (Cursor).

• Источник: ⚠️ https://docs.google.com/document/d/1GPDw0UzUkgfXRkWEDqCIanKDq3Tpvllyf08O-0eLyoQ/edit?usp=sharing
• Пользователь: 38.5 (UID 99979)
• Представление: 20.07.2026 08:21 (2 месяцы назад)
• Модерация: 22.09.2026 14:42 (2 months later)
• Статус: принято
• Запись VulDB: 408415 [Moonshot AI Kimi Code до 0.31.0 MCP Configuration Loader config-loader.ts эскалация привилегий]
• Баллы: 20