The vulnerability exists in the Kimi Agent SDK’s development scripts, vsix-publish.js and ovsx-publish.js, where filenames are passed directly to execSync as shell commands. This allows a malicious filename containing shell metacharacters (e.g., $(cmd)) to cause arbitrary commands to be executed during script run time. The weakness is a classic command injection flaw, classified as CWE-77. The impact is limited to developers executing these publish scripts; normal end‑user installation of the published VSCode extension is not affected.

MoonshotAI’s Kimi Agent SDK is vulnerable in all releases before 0.1.6, particularly versions that still expose the aforementioned scripts. The fix is provided in version 0.1.6 onwards, where execSync has been replaced with execFileSync and the invocation is safely passed as an array argument.

The assessed CVSS score is 2.9, reflecting low severity. The EPSS score is below 1 %, indicating a very low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Exploitation requires a developer to run the publish scripts with specially crafted filenames, so the attack vector is local and depends on the developer’s environment. In practice, this limits the real‑world risk, but the flaw is still a security concern for code‑base integrity.