CVE-2026-126758
Moonshot AI Kimi Code WorkspaceDirsService local.toml reliance on untrusted inputs in a security decision
CVSS Score
4.4
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was detected in Moonshot AI Kimi Code up to 2.0.2. This vulnerability affects unknown code of the file .kimi-code/local.toml of the component WorkspaceDirsService. Performing a manipulation of the argument additional_dir results in reliance on untrusted inputs in a security decision. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.1.0 is able to resolve this issue. Upgrading the affected component is recommended.
| CWE | CWE-807 CWE-20 |
| Vendor | moonshot ai |
| Product | kimi code |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for moonshot ai kimi code
Be the first to know when new medium vulnerabilities affecting moonshot ai kimi code are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Moonshot AI / Kimi Code
2.0.0 2.0.1 2.0.2
References
vuldb.com: https://vuldb.com/vuln/435868 vuldb.com: https://vuldb.com/vuln/435868/cti vuldb.com: https://vuldb.com/cve/CVE-2026-126758 vuldb.com: https://vuldb.com/submit/1033260 mcniyfj5bw9b.feishu.cn: https://mcniyfj5bw9b.feishu.cn/docx/LsJldjpjXomkb4xTJ6CcWzdFnvd github.com: https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%402.1.0
Credits
🔍 ShiyuFan_BinYuan (VulDB User)