PT-2026-145544

CVE-2026-126758

Published

2026-11-11

Updated

2026-11-11

Description by

CVSS 3.1

4.4

Medium

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

A vulnerability was detected in Moonshot AI Kimi Code up to 2.0.2. This vulnerability affects unknown code of the file .kimi-code/local.toml of the component WorkspaceDirsService. Performing a manipulation of the argument additional dir results in reliance on untrusted inputs in a security decision. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.1.0 is able to resolve this issue. Upgrading the affected component is recommended.

Exploitability

Exploit

Fix

Impacts

Researchers

Shiyufan_Binyuan

Vendors

Affected products

Weakness enumeration

CWE-807: Reliance on Untrusted Inputs in a Security Decision

CWE-20: Improper Input Validation

Related identifiers