A vulnerability in aiohttp's CookieJar persistence causes host-only cookies saved and later restored from disk to lose their host-only status. This results in cookies being sent to subdomains that should not receive them, potentially exposing sensitive cookie data. The issue affects versions of the kimi-cli product from 0.40 onward. A patch is available to address this behavior.