CVE-2026-126758

CVSS 4.4 (medium) · published 2026-11-11

A vulnerability was detected in Moonshot AI Kimi Code up to 2.0.2. This vulnerability affects unknown code of the file .kimi-code/local.toml of the component WorkspaceDirsService. Performing a manipulation of the argument additional_dir results in reliance on untrusted inputs in a security decision. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.1.0 is able to resolve this issue. Upgrading the affected component is recommended.

Weakness: CWE-20, CWE-807

Source: NVD CVE-2026-126758

References

• https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%402.1.0
• https://mcniyfj5bw9b.feishu.cn/docx/LsJldjpjXomkb4xTJ6CcWzdFnvd
• https://vuldb.com/cve/CVE-2026-126758
• https://vuldb.com/submit/1033260
• https://vuldb.com/vuln/435868
• https://vuldb.com/vuln/435868/cti

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.