CVE-2026-95660: Moonshot AI Kimi Code OS command injection in MCP configuration loader

Summary

CVE-2026-95660 is a flaw in Moonshot AI Kimi Code up to 0.31.0, in an unknown function of agent-core-v2/src/agent/mcp/config-loader.ts within the MCP Configuration Loader component. Manipulating it results in OS command injection, and the attack may be launched remotely. The exploit has been released publicly and may be used for attacks.

Mitigation

Upgrade to version 0.31.1. The fix also resolves fd and stty binaries to absolute paths so untrusted workspaces cannot plant bare-name executables before confirmation, addressing a secondary $PATH path-planting vector alongside the primary untrusted-.mcp.json auto-spawn.

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News