Kimi Code
Monthly
OS command injection in Moonshot AI's Kimi Code (versions 0.31.0 and earlier) lets an attacker-controlled .mcp.json file in an untrusted workspace be auto-spawned by the MCP Configuration Loader before any trust confirmation, executing arbitrary OS commands on the developer's machine. Exploitation requires the victim to open or operate on the malicious workspace (user interaction) and to run a pre-0.31.1 version; publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV). Although the vendor rates this CVSS 4.0 at only 2.1, an independent assessment scores it 7.8 (CVSS 3.1, AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H) because CWE-78 command injection inside an AI agent's configuration loader normally yields full code execution.
OS command injection in Moonshot AI's Kimi Code (versions 0.31.0 and earlier) lets an attacker-controlled .mcp.json file in an untrusted workspace be auto-spawned by the MCP Configuration Loader before any trust confirmation, executing arbitrary OS commands on the developer's machine. Exploitation requires the victim to open or operate on the malicious workspace (user interaction) and to run a pre-0.31.1 version; publicly available exploit code exists, but there is no confirmed active exploitation (no CISA KEV). Although the vendor rates this CVSS 4.0 at only 2.1, an independent assessment scores it 7.8 (CVSS 3.1, AV:L/AC:L/PR:N/UI:R, C:H/I:H/A:H) because CWE-78 command injection inside an AI agent's configuration loader normally yields full code execution.