Description
A security vulnerability has been detected in Moonshot AI Kimi Code up to 2.5.2. This affects the function isOriginAllowed of the file apps/kimi-code/dist-web/assets/index-HU0LCM-X.js of the component Web UI. Such manipulation of the argument kimi_origin leads to open redirect. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Moonshot AI | Kimi Code | 2.5.0, 2.5.1, 2.5.2 | — |
References
- VDB-435867 | Moonshot AI Kimi Code Web UI index-HU0LCM-X.js isOriginAllowed redirect vdb-entry technical-description
- VDB-435867 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-126757 | CVE Analysis and Report third-party-advisory
- Submit #1033259 | 北京月之暗面科技股份有限公司 kimi code 0.42.0 Kimi Code 默认配置RCE 无需开启危险模式 third-party-advisory
- https://mcniyfj5bw9b.feishu.cn/docx/IZ43dY0wzoDtnUxGgy7cQ6xcnFh exploit