Skip to content
OpenAdvisories

Product · MoonshotAI

Kimi Code

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.5
    CVE-2026-17534

    Kimi Code FetchURL SSRF protection bypass via DNS-resolving hostnames and redirects

    Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a Fetch…

    MoonshotAI Kimi Code