CVE-2026-95660 - Vulnerability Details

- Moonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injection

Description

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.31.1 is sufficient to fix this issue. It is recommended to upgrade the affected component. Beyond the trust prompt, the fix resolves fd/stty binaries to absolute paths specifically "so untrusted workspaces cannot plant bare-name executables before confirmation," fixing a secondary $PATH path-planting vector alongside the primary untrusted-.mcp.json auto-spawn.

Published: 2026-09-22

Score: 5.3 Medium

EPSS: 1.7% Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw is an OS command injection in the MCP Configuration Loader component of Moonshot AI Kimi Code. It allows an attacker to supply malicious input that is executed by the underlying operating system. This vulnerability falls under CWE-77 and CWE-78, meaning that arbitrary commands can be run with the privileges of the application. If exploited, an attacker can gain full control of the host, exfiltrate data, or deploy further malware.

Affected Systems

Moonshot AI Kimi Code versions up to and including 0.31.0 are affected. The issue was resolved in 0.31.1. No other products or versions are listed as vulnerable.

Risk and Exploitability

The CVSS score of 5.3 reflects a moderate severity. The EPSS score is 2%, but a public exploit has been released, indicating that an attacker could launch the attack remotely through the untrusted .mcp.json auto-spawn mechanism or by planting binaries in the $PATH before the trust prompt is confirmed. Because it is not listed in CISA’s KEV catalog, it has not yet been widely reported by CISA, yet the presence of a public exploit warrants prompt attention.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Moonshot AI

Kimi Code

affected

Version	Status	Constraints
`0.1`	affected	—
`0.2`	affected	—
`0.3`	affected	—
`0.4`	affected	—
`0.5`	affected	—
`0.6`	affected	—
`0.7`	affected	—
`0.8`	affected	—
`0.9`	affected	—
`0.10`	affected	—
`0.11`	affected	—
`0.12`	affected	—
`0.13`	affected	—
`0.14`	affected	—
`0.15`	affected	—
`0.16`	affected	—
`0.17`	affected	—
`0.18`	affected	—
`0.19`	affected	—
`0.20`	affected	—
`0.21`	affected	—
`0.22`	affected	—
`0.23`	affected	—
`0.24`	affected	—
`0.25`	affected	—
`0.26`	affected	—
`0.27`	affected	—
`0.28`	affected	—
`0.29`	affected	—
`0.30`	affected	—
`0.31.0`	affected	—
`0.31.1`	unaffected	—

No data.

Vendor Product Confidence Versions

Moonshotai

Kimi Code

95%

Version	Status	Scheme	Platform
`[0.1,0.31.0]`	affected	semver	—
`0.31.1`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Moonshot AI Kimi Code to version 0.31.1 or later to apply the command injection fix.
Verify that the installed binaries for fd and stty use absolute paths and have correct permissions to prevent path planting.
Remove or quarantine any untrusted .mcp.json files and restrict untrusted workspaces from executing arbitrary commands until verified.

Generated by OpenCVE AI on September 23, 2026 at 15:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.01665.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://docs.google.com/document/d/1GPDw0UzUkgfXRkWEDqCIanKDq3Tpvllyf08O-0eLyoQ/edit?tab=t.0
https://docs.google.com/document/d/1GPDw0UzUkgfXRkWEDqCIanKDq3Tpvllyf08O-0eLyoQ/edit?usp=sharing
https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%400.31.1
https://vuldb.com/cve/CVE-2026-95660
https://vuldb.com/submit/897071
https://vuldb.com/vuln/408415
https://vuldb.com/vuln/408415/cti

History

Tue, 22 Sep 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 22 Sep 2026 20:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Moonshotai Moonshotai kimi Code
Vendors & Products		Moonshotai Moonshotai kimi Code

Tue, 22 Sep 2026 19:30:00 +0000

Type	Values Removed	Values Added
References		https://docs.google.com/document/d/1GPDw0UzUkgfXRkWEDqCIanKDq3Tpvllyf08O-0eLyoQ/edit?tab=t.0

Tue, 22 Sep 2026 18:15:00 +0000

Type	Values Removed	Values Added
Description		A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.31.1 is sufficient to fix this issue. It is recommended to upgrade the affected component. Beyond the trust prompt, the fix resolves fd/stty binaries to absolute paths specifically "so untrusted workspaces cannot plant bare-name executables before confirmation," fixing a secondary $PATH path-planting vector alongside the primary untrusted-.mcp.json auto-spawn.
Title		Moonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injection
First Time appeared		Moonshot Ai Moonshot Ai kimi Code
Weaknesses		CWE-77 CWE-78
CPEs		cpe:2.3:a:moonshot_ai:kimi_code::::::::
Vendors & Products		Moonshot Ai Moonshot Ai kimi Code
References		https://docs.google.com/document/d/1GPDw0UzUkgfXRkWEDqCIanKDq3Tpvllyf08O-0eLyoQ/edit?usp=sharing https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%400.31.1 https://vuldb.com/cve/CVE-2026-95660 https://vuldb.com/submit/897071 https://vuldb.com/vuln/408415 https://vuldb.com/vuln/408415/cti
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Moonshot Ai Kimi Code

Moonshotai Kimi Code

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-22T18:00:11.243Z

Updated: 2026-09-22T19:05:35.649Z

Reserved: 2026-09-22T12:42:33.085Z

Link: CVE-2026-95660

Vulnrichment

Updated: 2026-09-22T19:05:20.243Z

NVD

Status : Deferred

Published: 2026-09-22T18:17:37.750

Modified: 2026-09-22T19:16:59.953

Link: CVE-2026-95660

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-23T15:45:06Z

Weaknesses

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object