Is CVE-2026-79294 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79294 being exploited in the wild.

How severe is CVE-2026-79294?

Medium severity, with a CVSS score of 6.1, published 18 September 2026.

Which products and versions are affected?

Moonshot AI Kimi as of 2026-07-18.

Is there a fix for CVE-2026-79294?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-79294 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-79294?

Check whether you run Moonshot AI Kimi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79294: Moonshot AI Kimi cross-site scripting in HTML artifact preview

CVE-2026-79294 · Severity: medium · CVSS 6.1 · Published 2026-09-18

Moonshot AI Kimi is an AI assistant platform that allows users to create and share conversations and content artifacts. A cross-site scripting (XSS) vulnerability in the HTML artifact preview and public share view allows an attacker to inject malicious code that executes in a victim's browser, potentially leading to data theft, session hijacking, or unauthorized actions performed on behalf of the user.

Vendors: Moonshot AI.

Quick answers

Is CVE-2026-79294 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79294 being exploited in the wild.
How severe is CVE-2026-79294?: Medium severity, with a CVSS score of 6.1, published 18 September 2026.
Which products and versions are affected?: Moonshot AI Kimi as of 2026-07-18.
Is there a fix for CVE-2026-79294?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-79294 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-79294?: Check whether you run Moonshot AI Kimi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a reflected or stored cross-site scripting (XSS) flaw in the HTML artifact preview rendering component of Moonshot AI Kimi. The vulnerable component fails to properly sanitize or encode HTML content when rendering artifacts in the public share view. An attacker can craft a malicious artifact containing JavaScript payload that executes in the browser of any user viewing the shared artifact, without requiring authentication. The attack vector is network-based and requires only that a victim click a malicious link or visit a shared artifact URL. No patch information is currently available in the advisory.

Affected products

Moonshot AI Kimi as of 2026-07-18

Timeline

2026-09-18: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.