Vibe Coding
Kimi Code CVE-2026-95660: an untrusted .mcp.json auto-spawns commands, fixed in 0.31.1
NVD published CVE-2026-95660 on 2026-09-22 against Moonshot AI Kimi Code up to 0.31.0. The MCP configuration loader (agent-core-v2/src/agent/mcp/config-loader.ts) auto-spawned servers from an untrusted workspace's .mcp.json, which is OS command injection by opening a repo. The 0.31.1 fix adds a trust prompt and resolves fd/stty to absolute paths so a workspace cannot plant bare-name executables on $PATH before confirmation. NVD notes a public exploit. It is the same repo-config auto-execution class other agent CLIs have already patched.
Source
↳ Follow the thread