CVE-2026-95660: Kimi Code trusts executable workspace configuration

Tracking: CVE-2026-95660
Severity: Medium (CVSS 3.1: 6.3)

Who is affected

Moonshot AI Kimi Code through 0.31.0. The attacker must influence a workspace or MCP configuration that the target opens or loads.

How the attack works

The MCP configuration loader in agent-core-v2 can start commands from an untrusted .mcp.json before the expected trust boundary is enforced. The report also identifies a binary-planting path: resolving fd or stty through an attacker-influenced PATH can run a substituted executable before confirmation.

Both paths execute with the Kimi Code account's permissions. The issue depends on loading attacker-controlled workspace material, rather than an arbitrary remote message automatically gaining execution.

What to do

1. Upgrade to 0.31.1 or later. The fix addresses configuration trust and uses absolute paths for the reported helper commands.
2. Review .mcp.json and project executables before opening unfamiliar workspaces. Keep untrusted directories out of executable search paths.
3. Inspect unexpected child processes or helper binaries if a suspicious workspace was already used.

Scope and limits

The CVE record references a public demonstration. That does not establish exploitation of every affected installation.

Sources

• Original advisory or incident report