Threats tagged 'ghsa-wpx2-j9xr-rxgh'

A security vulnerability (CVE-2026-126757) exists in Moonshot AI Kimi Code up to version 2.5.2 affecting the Web UI component. The flaw is an open redirect caused by manipulation of the 'kimi_origin' argument in the isOriginAllowed function within a JavaScript file. This vulnerability can be exploited remotely and public exploit details have been disclosed. The vendor has not responded to the disclosure. The CVSS score is 4.3, indicating medium severity.