Kimi Code EUVD-2026-84628

Exploitation requires the victim to run Moonshot AI Kimi Code (≤0.31.0) inside an UNTRUSTED workspace that contains an attacker-controlled .mcp.json, which the MCP Configuration Loader auto-spawns before/without a trust confirmation, injecting OS commands. A secondary vector requires the untrusted workspace to plant a bare-name executable (e.g., fd or stty) resolvable via $PATH before confirmation. Limiting factors: the attacker cannot trigger this against a server - a developer must open/operate on the malicious workspace (UI:P/UI:R), the target must be a pre-0.31.1 version, and the fix (absolute-path resolution of fd/stty plus the trust prompt) neutralizes both the auto-spawn and path-planting paths.

The vendor (VulDB) rates this CVSS 4.0 at only 2.1, driven by low sub-scores across the board (VC:L/VI:L/VA:L) and UI:P, yet the underlying flaw is an OS command injection (CWE-78) in the MCP Configuration Loader - a class that normally yields full arbitrary code execution. This is a notable conflict: the CVSS impact metrics understate the technical severity of command injection, which realistically grants arbitrary code execution in the context of the user running Kimi Code. Balancing signals: a public exploit exists (POC=YES, SSVC/CVSS E:P 'Proof-of-Concept'), but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation. Crucially, exploitation is gated: it requires a victim to run Kimi Code inside an untrusted workspace containing a malicious .mcp.json that auto-spawns processes (plus a secondary $PATH path-planting vector via bare-name fd/stty binaries). The 'attack may be launched remotely' framing reflects that the malicious repository is delivered remotely, but triggering still depends on the victim opening/operating on that untrusted workspace locally (UI is required). Net: this is a real, patched, publicly-exploitable weakness that matters for developers using AI coding agents on untrusted code, but it is not a mass-exploitation, unauthenticated-server priority - treat as a targeted supply-chain/workspace-trust risk. The vendor's 2.1 score materially understates the impact of a command-injection primitive; verify impact independently.

An attacker publishes a repository (or tricks a developer into cloning one) containing a malicious .mcp.json; when the victim opens that untrusted workspace in Kimi Code ≤0.31.0, the MCP Configuration Loader auto-spawns the attacker-defined server, executing injected OS commands as the developer. A secondary variant plants a bare-name executable (e.g., a fake fd or stty) in the workspace so it is resolved via $PATH before the trust confirmation. A public proof-of-concept exists (linked from VulDB), so exploitation requires little attacker development effort.