CVE-2026-126758: Moonshot AI Kimi Code WorkspaceDirsService local.toml reliance on untrusted inputs in a security decision
A vulnerability was detected in Moonshot AI Kimi Code up to 2.0.2. This vulnerability affects unknown code of the file .kimi-code/local.toml of the component WorkspaceDirsService. Performing a manipulation of the argument additionaldir results in reliance on untrusted inputs in a security decision. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.1.0 is able to resolve this issue. Upgrading the affected component is recommended.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Moonshot AI Kimi Codeto a version that resolves this vulnerability.Fixed in 2.1.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Moonshot AI Kimi Code versions up to 2.0.2 are affected where the WorkspaceDirsService processes the additional_dir value in .kimi-code/local.toml. Exploitation requires local access and low-level privileges.
What does an attacker need to exploit it?
An attacker needs the ability to locally manipulate the additional_dir argument associated with .kimi-code/local.toml. No user interaction is required.
Is a public exploit available?
Yes. The exploit is public and may be used.
What should be done to remediate the issue?
Upgrade Moonshot AI Kimi Code to version 2.1.0, which resolves the issue. Upgrading the affected component is recommended.