Starlette: Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. (CVE-2026-54282)

CVE-2026-54282 describes a vulnerability in the Starlette framework component used by kimi-cli, where the HTTP request path is not validated before reconstructing the request URL. Specifically, if the request path does not start with a slash, the URL parser treats the path as part of the authority section, resulting in an attacker-controlled hostname in request.url.hostname. This can mislead security mechanisms that depend on the hostname for authorization or redirects. The issue is resolved by upgrading to a patched version that performs proper validation.

The vulnerability allows an attacker to manipulate the hostname portion of the reconstructed request URL by crafting a request path without a leading slash. This can cause security-sensitive code relying on request.url.hostname for host-based authorization or redirects to be misled, potentially bypassing security controls. There is no indication of confidentiality or availability impact, and no known exploits in the wild have been reported.

Upgrade to Starlette version 1.3.0 or later, where the vulnerability is fixed by proper validation of the request path before URL reconstruction. No other mitigations are indicated or required.