CVE-2026-126757mediumCWE-601

CVE-2026-126757: medium-severity vulnerability in Moonshot AI Kimi Code

Moonshot AI Kimi Code Web UI index-HU0LCM-X.js isOriginAllowed redirect

Published

Follow this CVE+ Monitor Kimi Code

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

30Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3
A security vulnerability has been detected in Moonshot AI Kimi Code up to 2.5.2. This affects the function isOriginAllowed of the file apps/kimi-code/dist-web/assets/index-HU0LCM-X.js of the component Web UI. Such manipulation of the argument kimi_origin leads to open redirect. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
Moonshot AI · Kimi Code
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Moonshot AI Kimi Code

In the same product, most dangerous first.

CVE-2026-95660MEDIUMMoonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injectionEPSS 1.7%CVE-2026-126758MEDIUMMoonshot AI Kimi Code WorkspaceDirsService local.toml reliance on untrusted inputs in a security decisionEPSS —