---
id: "CVE-2026-126758"
page: "https://infrastack.ai/live/CVE-2026-126758"
kind: "vulnerability"
aliases: ["CVE-2026-126758"]
title: "Kimi Code: local config file lets untrusted input bypass workspace directory checks"
severity: "medium"
cvss: 4.4
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-coding-agent", "ai-tooling", "kimi-code", "local-dev"]
not_affected_if: ["kimi-code-2.1.0-or-later", "no-untrusted-workspaces"]
published_at: "2026-11-11T23:17:11+00:00"
first_seen_at: "2026-11-11T23:29:35+00:00"
updated_at: "2026-11-11T23:31:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126758", "first_seen_at": "2026-11-11T23:29:35+00:00"}]
exploit_sources: []
---

# Kimi Code: local config file lets untrusted input bypass workspace directory checks

Link for people: https://infrastack.ai/live/CVE-2026-126758 (this .md is for agents)

Moonshot AI's Kimi Code coding agent reads an additional_dir setting from .kimi-code/local.toml and trusts it in a security decision. A local attacker who can place or change that file can widen which directories the agent is allowed to access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kimi Code version and see whether it is `2.0.2` or earlier.
- Look for a `.kimi-code/local.toml` file in project workspaces and check for an `additional_dir` entry.

## Fix

- Kimi Code: upgrade to `2.1.0`.

## Timeline

- 2026-11-11T23:29:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126758

## Documents

- [fix] Release notes: github.com https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%402.1.0

## From the sources

A vulnerability was detected in Moonshot AI Kimi Code up to 2.0.2. This vulnerability affects unknown code of the file .kimi-code/local.toml of the component WorkspaceDirsService. Performing a manipulation of the argument additional_dir results in reliance on untrusted inputs in a security decision. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.1.0 is able to resolve this issue. Upgrading the affected component is recommended.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_