CVE-2026-95660: Moonshot AI Kimi Code RCE Vulnerability

CVE-2026-95660 Overview

CVE-2026-95660 is an operating system command injection vulnerability in Moonshot AI Kimi Code versions up to and including 0.31.0. The flaw resides in the agent-core-v2/src/agent/mcp/config-loader.ts file within the MCP Configuration Loader component. An attacker can trigger the issue remotely when a user interacts with an untrusted workspace containing a malicious .mcp.json file. A secondary $PATH path-planting vector allows bare-name executables such as fd or stty to be resolved to attacker-controlled binaries before user confirmation. The exploit has been publicly released. Upgrading to version 0.31.1 remediates the issue.

Critical Impact
Untrusted workspaces can auto-spawn attacker-controlled processes through malicious MCP configuration files, resulting in command execution on the developer's host.

Affected Products

Moonshot AI Kimi Code versions up to 0.31.0
MCP Configuration Loader component (agent-core-v2/src/agent/mcp/config-loader.ts)
Fixed in Moonshot AI Kimi Code 0.31.1

Discovery Timeline

2026-09-22 - CVE-2026-95660 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-95660

Vulnerability Analysis

The vulnerability is classified under CWE-77: Improper Neutralization of Special Elements used in a Command. Kimi Code's MCP Configuration Loader processes .mcp.json files present in the active workspace. Untrusted configurations can auto-spawn processes before a user's trust decision is enforced, enabling OS command injection.

The fix introduces a trust prompt to gate configuration loading. It also resolves the fd and stty helper binaries to absolute paths. According to the vendor, this hardening exists "so untrusted workspaces cannot plant bare-name executables before confirmation," closing a secondary $PATH path-planting vector.

Exploitation requires user interaction with a hostile workspace, which limits attack scale. However, developers routinely open shared repositories, so the vector is realistic for supply chain and targeted scenarios.

Root Cause

The loader trusted workspace-provided MCP configuration data and invoked helper binaries by bare name. Bare-name invocation causes the OS to search $PATH, allowing a repository to ship an executable that shadows the intended system tool. Combined with auto-spawn behavior before trust confirmation, this yields command injection.

Attack Vector

An attacker publishes or shares a repository containing a crafted .mcp.json and a companion executable named fd or stty placed in a directory that appears early in $PATH. When a victim opens the workspace in Kimi Code, the MCP Configuration Loader auto-spawns processes and resolves helper binaries against the attacker-controlled $PATH entry, executing arbitrary commands under the victim's account.

No authentication is required, and the attack is network-reachable through repository distribution channels. See the GitHub Release Notes for 0.31.1 and the VulDB CVE-2026-95660 entry for further technical detail.

Detection Methods for CVE-2026-95660

Indicators of Compromise

Presence of unexpected .mcp.json files in cloned or shared workspaces that reference external commands or bare-name binaries.
Local repository directories containing executables named fd, stty, or other common utilities that shadow system tools.
Child processes spawned by the Kimi Code agent immediately after opening a new workspace, prior to any user trust confirmation.

Detection Strategies

Inventory installed Kimi Code versions across developer endpoints and flag any instance at 0.31.0 or earlier.
Alert when the Kimi Code process launches shells or helper binaries resolved from non-system $PATH locations, such as workspace directories.
Scan repositories at ingestion for .mcp.json files that reference network commands, shell interpreters, or unsigned executables.

Monitoring Recommendations

Log process creation events with full command lines and resolved executable paths on developer workstations.
Monitor modifications to $PATH in shell profiles and IDE-launched process environments.
Track new or modified .mcp.json files in monitored source repositories and flag anomalous entries for review.

How to Mitigate CVE-2026-95660

Immediate Actions Required

Upgrade Moonshot AI Kimi Code to version 0.31.1 or later on all developer systems.
Audit developer machines for untrusted .mcp.json files and remove any not authored by a trusted source.
Remove workspace-relative directories from user $PATH entries to prevent bare-name binary shadowing.

Patch Information

The vendor fix is available in Moonshot AI Kimi Code 0.31.1. Details are published in the GitHub Release Notes. The patch adds a trust prompt for MCP configurations and resolves fd and stty binaries to absolute paths, closing both the auto-spawn and $PATH path-planting vectors.

Workarounds

Only open Kimi Code workspaces from repositories authored by trusted sources until the upgrade is complete.
Manually inspect any .mcp.json file before allowing Kimi Code to load a new workspace.
Configure endpoint controls to block execution of unsigned binaries dropped inside developer project directories.

bash

# Configuration example
# Verify installed Kimi Code version
npm ls -g @moonshot-ai/kimi-code

# Upgrade to the patched release
npm install -g @moonshot-ai/kimi-code@0.31.1

# Audit workspaces for MCP configuration files before opening
find . -name '.mcp.json' -maxdepth 3 -print