CVE-2026-126757

MEDIUM 4.3

Moonshot AI Kimi Code Web UI index-HU0LCM-X.js isOriginAllowed redirect

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

A security vulnerability has been detected in Moonshot AI Kimi Code up to 2.5.2. This affects the function isOriginAllowed of the file apps/kimi-code/dist-web/assets/index-HU0LCM-X.js of the component Web UI. Such manipulation of the argument kimi_origin leads to open redirect. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-601
Vendor	moonshot ai
Product	kimi code
Published	Nov 11, 2026

Stay Ahead of the Next One

Get instant alerts for moonshot ai kimi code

Be the first to know when new medium vulnerabilities affecting moonshot ai kimi code are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Moonshot AI / Kimi Code

2.5.0 2.5.1 2.5.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/435867 vuldb.com: https://vuldb.com/vuln/435867/cti vuldb.com: https://vuldb.com/cve/CVE-2026-126757 vuldb.com: https://vuldb.com/submit/1033259 mcniyfj5bw9b.feishu.cn: https://mcniyfj5bw9b.feishu.cn/docx/IZ43dY0wzoDtnUxGgy7cQ6xcnFh

Credits

🔍 ShiyuFan_BinYuan (VulDB User) VulDB CNA Team