Is CVE-2026-95660 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95660 being exploited in the wild.

How severe is CVE-2026-95660?

Medium severity, with a CVSS score of 6.3, published 22 September 2026.

Which products and versions are affected?

Moonshot AI Kimi Code up to 0.31.0.

Is there a fix for CVE-2026-95660?

A patch was published on 2026-07-31: Version 0.31.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-95660 attacked?

It is attacked over the network.

Am I affected by CVE-2026-95660?

Check whether you run Moonshot AI Kimi Code at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95660: Moonshot AI Kimi Code arbitrary command injection in MCP configuration loader

CVE-2026-95660 · Severity: medium · CVSS 6.3 · Published 2026-09-22

Moonshot AI Kimi Code is a development environment that automatically loads Model Context Protocol (MCP) configurations from project files. An attacker can craft a malicious .mcp.json file in a project directory that executes arbitrary OS commands when a user opens the project, without any explicit user action or confirmation beyond opening the workspace. This allows code execution with the same privileges as the user running Kimi Code.

Technologies: Moonshot AI Kimi Code. Vendors: Moonshot AI.

Quick answers

Is CVE-2026-95660 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95660 being exploited in the wild.
How severe is CVE-2026-95660?: Medium severity, with a CVSS score of 6.3, published 22 September 2026.
Which products and versions are affected?: Moonshot AI Kimi Code up to 0.31.0.
Is there a fix for CVE-2026-95660?: A patch was published on 2026-07-31: Version 0.31.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-95660 attacked?: It is attacked over the network.
Am I affected by CVE-2026-95660?: Check whether you run Moonshot AI Kimi Code at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an OS command injection in the MCP Configuration Loader component (agent-core-v2/src/agent/mcp/config-loader.ts) triggered by auto-execution of untrusted .mcp.json files from the project directory. The attack requires the victim to open a malicious project but does not require any user interaction beyond that. The fix resolves fd/stty binary names to absolute paths to prevent $PATH planting attacks that allow injecting executables before the actual commands are invoked.

Affected products

Moonshot AI Kimi Code up to 0.31.0

Timeline

2026-09-22: disclosed
2026-07-31: patched: Version 0.31.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.