Skip to content
OpenAdvisories

Vendor

Moonshot AI

5 known vulnerabilities.

Products

Kimi Code 4 kimi-agent-sdk 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 2.9
    CVE-2026-25046

    [Kimi VS Code] Command Injection in publish scripts vsix-publish.js and ovsx-publish.js

    Kimi Agent SDK is a set of libraries that expose the Kimi Code (Kimi CLI) agent runtime in applications. The vsix-publish.js and ovsx-publish.js scripts pass filenames to execSync() as shell command strings. Prior to version 0.1.6, filenames containing shell …

    Moonshot AI kimi-agent-sdk