CVE-2026-95660: OS Command Injection in Moonshot AI Kimi Code
A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.31.1 is sufficient to fix this issue. It is recommended to upgrade the affected component. Beyond the trust prompt, the fix resolves fd/stty binaries to absolute paths specifically "so untrusted workspaces cannot plant bare-name executables before confirmation," fixing a secondary $PATH path-planting vector alongside the primary untrusted-.mcp.json auto-spawn.
AI Analysis
Technical Summary
Moonshot AI Kimi Code up to version 0.31.0 contains an OS command injection vulnerability in an unspecified function within the MCP Configuration Loader (agent-core-v2/src/agent/mcp/config-loader.ts). This vulnerability allows remote attackers to execute arbitrary OS commands due to improper handling of command paths. The fix in version 0.31.1 enforces absolute paths for fd/stty binaries, mitigating the risk of untrusted workspaces planting executables and preventing a secondary $PATH path-planting vector alongside the primary untrusted-.mcp.json auto-spawn issue.
Potential Impact
Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary OS commands on the affected system, potentially leading to unauthorized control or disruption of the application. The CVSS score of 5.3 indicates a medium severity impact with network attack vector, low complexity, no privileges required, and user interaction needed.
Mitigation Recommendations
Upgrade Moonshot AI Kimi Code to version 0.31.1 or later. This version contains an official fix that resolves the vulnerability by enforcing absolute paths for critical binaries and preventing path-planting attacks. No additional mitigation is required beyond applying this update.
CVE-2026-95660: OS Command Injection in Moonshot AI Kimi Code
Description
A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.31.1 is sufficient to fix this issue. It is recommended to upgrade the affected component. Beyond the trust prompt, the fix resolves fd/stty binaries to absolute paths specifically "so untrusted workspaces cannot plant bare-name executables before confirmation," fixing a secondary $PATH path-planting vector alongside the primary untrusted-.mcp.json auto-spawn.
CVSS v4.0
Score 5.3medium
Affected software
Moonshot AI
Kimi Code
cpe:2.3:a:moonshot_ai:kimi_code:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Moonshot AI Kimi Code up to version 0.31.0 contains an OS command injection vulnerability in an unspecified function within the MCP Configuration Loader (agent-core-v2/src/agent/mcp/config-loader.ts). This vulnerability allows remote attackers to execute arbitrary OS commands due to improper handling of command paths. The fix in version 0.31.1 enforces absolute paths for fd/stty binaries, mitigating the risk of untrusted workspaces planting executables and preventing a secondary $PATH path-planting vector alongside the primary untrusted-.mcp.json auto-spawn issue.
Potential Impact
Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary OS commands on the affected system, potentially leading to unauthorized control or disruption of the application. The CVSS score of 5.3 indicates a medium severity impact with network attack vector, low complexity, no privileges required, and user interaction needed.
Mitigation Recommendations
Upgrade Moonshot AI Kimi Code to version 0.31.1 or later. This version contains an official fix that resolves the vulnerability by enforcing absolute paths for critical binaries and preventing path-planting attacks. No additional mitigation is required beyond applying this update.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-22T12:42:33.085Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab2c670f7a7c541068f9230
Added to database: 09/22/2026, 18:18:24 UTC
Last enriched: 09/22/2026, 18:32:57 UTC
Last updated: 09/23/2026, 01:58:06 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.