Description
Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component
Published: 2026-09-18
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a cross‑site scripting flaw that allows a remote attacker to execute arbitrary code via the HTML artifact preview rendering in the public Share view component. The attack vector relies on the attacker crafting a malicious HTML artifact that is then rendered by the Share view, leading to execution of injected scripts. The impact is a full compromise of the affected system’s confidentiality, integrity, and availability.

Affected Systems

Moonshot AI Kimi, any version as of 2026‑07‑18. No specific version details are available.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity, and the EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. A remote attacker can exploit the flaw by accessing the public Share view component and delivering a malicious HTML artifact. No additional privileged access or local conditions are required.

Generated by OpenCVE AI on September 19, 2026 at 18:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Moonshot AI Kimi to the latest version that addresses the HTML artifact XSS flaw.
  • If an update is unavailable, disable or restrict the public Share view component so that only trusted users can render artifacts until a fix is applied.
  • Implement a strict content‑security policy and perform server‑side sanitization of all user‑supplied HTML content to block script execution.

Generated by OpenCVE AI on September 19, 2026 at 18:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 19 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
First Time appeared Moonshotai
Moonshotai kimi Code
Vendors & Products Moonshotai
Moonshotai kimi Code

Sat, 19 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Title Cross‑Site Scripting via HTML Artifact Preview in Moonshot AI Kimi

Fri, 18 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Title Cross‑Site Scripting via HTML Artifact Preview in Moonshot AI Kimi

Fri, 18 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-79
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Fri, 18 Sep 2026 14:00:00 +0000

Type Values Removed Values Added
Description Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component
References

Subscriptions

Moonshotai Kimi Code
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-18T15:01:08.894Z

Reserved: 2026-08-25T00:00:00.000Z

Link: CVE-2026-79294

cve-icon Vulnrichment

Updated: 2026-09-18T14:59:50.097Z

cve-icon NVD

Status : Deferred

Published: 2026-09-18T14:18:48.077

Modified: 2026-09-22T20:00:03.713

Link: CVE-2026-79294

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-19T22:30:53Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')