CVE-2026-126758 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Moonshot AI's Kimi Code coding agent reads an additional_dir setting from .kimi-code/local.toml and trusts it in a security decision. A local attacker who can place or change that file can widen which directories the agent is allowed to access.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run Kimi Code on a workstation or shared machine with untrusted repositories or config files in the workspace. The attack needs local access to write the workspace config, so machines that only open trusted repositories are lower risk.
Not affected if kimi-code-2.1.0-or-later, no-untrusted-workspaces
Who cares ai-coding-agent, kimi-code, local-dev
2.0.2 or earlier..kimi-code/local.toml file in project workspaces and check for an additional_dir entry.2.1.0.A vulnerability was detected in Moonshot AI Kimi Code up to 2.0.2. This vulnerability affects unknown code of the file .kimi-code/local.toml of the component WorkspaceDirsService. Performing a manipulation of the argument additional_dir results in reliance on untrusted inputs in a security decision. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.1.0 is able to resolve this issue. Upgrading the affected component is recommended.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.