CVE-2026-126757: Moonshot AI Kimi Code Web UI index-HU0LCM-X.js isOriginAllowed redirect
A security vulnerability has been detected in Moonshot AI Kimi Code up to 2.5.2. This affects the function isOriginAllowed of the file apps/kimi-code/dist-web/assets/index-HU0LCM-X.js of the component Web UI. Such manipulation of the argument kimiorigin leads to open redirect. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
Which deployments are affected?
Moonshot AI Kimi Code versions up to 2.5.2 are affected in the Web UI component, specifically the isOriginAllowed function in apps/kimi-code/dist-web/assets/index-HU0LCM-X.js.
What does an attacker need to exploit this issue?
The attack can be performed remotely without stated privileges, but user interaction is required. Exploitation involves manipulating the kimi_origin argument to trigger an open redirect.
Is public exploit information available?
Yes. A proof of concept has been flagged, and the exploit has been publicly disclosed.
Is a vendor fix or response available?
No vendor response is reported. The vendor was contacted early regarding the disclosure but did not respond.