Kimi Code implements an SSRF hardening mechanism that relies solely on a static denylist of hostnames and IP literals. The implementation does not resolve DNS names or re‑validate hosts after HTTP redirects, so an attacker can supply a publicly resolvable hostname that points to a loopback or private address, or a URL that redirects to such a target. This bypass allows the attacker to reach internal network services that the denylist was meant to block, leading to potential compromise or data exfiltration on the internal network. The weakness is classified as CWE‑918.

MoonshotAI Kimi Code versions prior to 0.27.0 are affected. All releases before the 0.27.0 release lack the proper DNS resolution and redirect validation in the FetchURL hardening logic.

The CVSS score of 5.5 indicates moderate overall severity. Exploitation requires an attacker to influence a FetchURL invocation, such as through prompt injection or similar injection vectors that permit arbitrary URL construction. Because the vulnerability allows a bypass of internal address protection, any internal service reachable from the machine running Kimi Code could be accessed. The EPSS score is < 1%, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. Nonetheless, the potential for internal network compromise warrants timely remediation.