{"id":"CVE-2026-126758","kind":"vulnerability","aliases":["CVE-2026-126758"],"related":[],"title":"Kimi Code: local config file lets untrusted input bypass workspace directory checks","description":"A vulnerability was detected in Moonshot AI Kimi Code up to 2.0.2. This vulnerability affects unknown code of the file .kimi-code/local.toml of the component WorkspaceDirsService. Performing a manipulation of the argument additional_dir results in reliance on untrusted inputs in a security decision. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.1.0 is able to resolve this issue. Upgrading the affected component is recommended.","summary":"Moonshot AI's Kimi Code coding agent reads an additional_dir setting from .kimi-code/local.toml and trusts it in a security decision. A local attacker who can place or change that file can widen which directories the agent is allowed to access.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-coding-agent","ai-tooling","kimi-code","local-dev"],"not_affected_if":["kimi-code-2.1.0-or-later","no-untrusted-workspaces"],"how_to_check":"- Check the installed Kimi Code version and see whether it is `2.0.2` or earlier.\n- Look for a `.kimi-code/local.toml` file in project workspaces and check for an `additional_dir` entry.","fix":"- Kimi Code: upgrade to `2.1.0`.","status":"open","published_at":"2026-11-11T23:17:11+00:00","first_seen_at":"2026-11-11T23:29:35+00:00","triaged_at":"2026-11-11T23:31:23+00:00","updated_at":"2026-11-11T23:31:23+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-11T23:31:23Z","model":"claude-haiku-5-5","output":{"fix":"- Kimi Code: upgrade to `2.1.0`.","reach":"local","title":"Kimi Code: local config file lets untrusted input bypass workspace directory checks","impact":"medium","summary":"Moonshot AI's Kimi Code coding agent reads an additional_dir setting from .kimi-code/local.toml and trusts it in a security decision. A local attacker who can place or change that file can widen which directories the agent is allowed to access.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["kimi-code","ai-coding-agent","local-dev"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"local config can widen directories the agent may access","analyst_note":"Check the release notes linked from the sources to confirm the fix and whether an exploit is public; NVD gives no further detail on the attack path.","how_to_check":"- Check the installed Kimi Code version and see whether it is `2.0.2` or earlier.\n- Look for a `.kimi-code/local.toml` file in project workspaces and check for an `additional_dir` entry.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["kimi-code-2.1.0-or-later","no-untrusted-workspaces"],"who_is_affected":"Teams that run Kimi Code on a workstation or shared machine with untrusted repositories or config files in the workspace. The attack needs local access to write the workspace config, so machines that only open trusted repositories are lower risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000744,"input_tokens":4626,"output_tokens":562,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126758':15A,18A '-2026':14A,17A '/local.toml':48B,99C '2.0.2':87C '2.1.0':140C 'abl':142C 'access':75B 'addit':41B,110C 'affect':90C,149C 'agent':22B,38B,71B 'ai':20B,24B,33B,82C 'ai-coding-ag':19B 'ai-tool':23B 'allow':73B 'approach':127C 'argument':109C 'attack':58B,123C 'bypass':9A 'chang':63B 'check':12A 'code':2A,21B,28B,36B,37B,47B,84C,92C,98C 'compon':102C,150C 'config':4A 'cve':13A,16A 'decis':55B,121C 'detect':79C 'dev':31B 'dir':42B,111C 'directori':11A,69B 'exploit':129C 'file':5A,65B,95C 'input':8A,117C 'issu':146C 'kimi':1A,27B,35B,46B,83C,97C 'kimi-cod':26B,45B,96C 'let':6A 'local':3A,30B,57B,126C 'local-dev':29B 'manipul':106C 'may':134C 'moonshot':32B,81C 'perform':104C 'place':61B 'public':132C 'read':39B 'recommend':152C 'relianc':114C 'requir':124C 'resolv':144C 'result':112C 'secur':54B,120C 'set':43B 'tool':25B 'trust':50B 'unknown':91C 'untrust':7A,116C 'upgrad':137C,147C 'use':136C 'version':139C 'vulner':77C,89C 'widen':67B 'workspac':10A 'workspacedirsservic':103C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Kimi Code on a workstation or shared machine with untrusted repositories or config files in the workspace. The attack needs local access to write the workspace config, so machines that only open trusted repositories are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aicodingagent","aitooling","kimicode","localdev","medium"],"campaign_type":null,"search_a":"'-126758':15A,18A '-2026':14A,17A 'bypass':9A 'check':12A 'code':2A 'config':4A 'cve':13A,16A 'directori':11A 'file':5A 'input':8A 'kimi':1A 'let':6A 'local':3A 'untrust':7A 'workspac':10A","search_b":"'/local.toml':48B 'access':75B 'addit':41B 'agent':22B,38B,71B 'ai':20B,24B,33B 'ai-coding-ag':19B 'ai-tool':23B 'allow':73B 'attack':58B 'chang':63B 'code':21B,28B,36B,37B,47B 'decis':55B 'dev':31B 'dir':42B 'directori':69B 'file':65B 'kimi':27B,35B,46B 'kimi-cod':26B,45B 'local':30B,57B 'local-dev':29B 'moonshot':32B 'place':61B 'read':39B 'secur':54B 'set':43B 'tool':25B 'trust':50B 'widen':67B","search_c":"'/local.toml':99C '2.0.2':87C '2.1.0':140C 'abl':142C 'addit':110C 'affect':90C,149C 'ai':82C 'approach':127C 'argument':109C 'attack':123C 'code':84C,92C,98C 'compon':102C,150C 'decis':121C 'detect':79C 'dir':111C 'exploit':129C 'file':95C 'input':117C 'issu':146C 'kimi':83C,97C 'kimi-cod':96C 'local':126C 'manipul':106C 'may':134C 'moonshot':81C 'perform':104C 'public':132C 'recommend':152C 'relianc':114C 'requir':124C 'resolv':144C 'result':112C 'secur':120C 'unknown':91C 'untrust':116C 'upgrad':137C,147C 'use':136C 'version':139C 'vulner':77C,89C 'workspacedirsservic':103C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T23:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126758","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126758","severity":null,"published_at":"2026-11-11T23:17:11+00:00","modified_at":"2026-11-11T23:17:11+00:00","first_seen_at":"2026-11-11T23:29:35+00:00","fetched_at":"2026-11-11T23:29:35+00:00","note":null}],"documents":[{"id":129939,"url":"https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%402.1.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}