CVE-2026-25046

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25046", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-28T14:50:47.886Z", "datePublished": "2026-01-29T21:37:02.791Z", "dateUpdated": "2026-02-02T16:35:37.121Z"}, "containers": {"cna": {"title": "[Kimi VS Code] Command Injection in publish scripts vsix-publish.js and ovsx-publish.js", "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "lang": "en", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/MoonshotAI/kimi-agent-sdk/security/advisories/GHSA-mv58-gxx5-8hj3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/MoonshotAI/kimi-agent-sdk/security/advisories/GHSA-mv58-gxx5-8hj3"}], "affected": [{"vendor": "MoonshotAI", "product": "kimi-agent-sdk", "versions": [{"version": "< 0.1.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-29T21:37:02.791Z"}, "descriptions": [{"lang": "en", "value": "Kimi Agent SDK is a set of libraries that expose the Kimi Code (Kimi CLI) agent runtime in applications. The vsix-publish.js and ovsx-publish.js scripts pass filenames to execSync() as shell command strings. Prior to version 0.1.6, filenames containing shell metacharacters like $(cmd) could execute arbitrary commands. Note: This vulnerability exists only in the repository's development scripts. The published VSCode extension does not include these files and end users are not affected. This is fixed in version 0.1.6 by replacing execSync with execFileSync using array arguments. As a workaround, ensure .vsix files in the project directory have safe filenames before running publish scripts."}], "source": {"advisory": "GHSA-mv58-gxx5-8hj3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-30T14:38:25.647378Z", "id": "CVE-2026-25046", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T16:35:37.121Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25046", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-30T14:38:25.647378Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-30T14:38:29.541Z"}}], "cna": {"title": "[Kimi VS Code] Command Injection in publish scripts vsix-publish.js and ovsx-publish.js", "source": {"advisory": "GHSA-mv58-gxx5-8hj3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "MoonshotAI", "product": "kimi-agent-sdk", "versions": [{"status": "affected", "version": "< 0.1.6"}]}], "references": [{"url": "https://github.com/MoonshotAI/kimi-agent-sdk/security/advisories/GHSA-mv58-gxx5-8hj3", "name": "https://github.com/MoonshotAI/kimi-agent-sdk/security/advisories/GHSA-mv58-gxx5-8hj3", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Kimi Agent SDK is a set of libraries that expose the Kimi Code (Kimi CLI) agent runtime in applications. The vsix-publish.js and ovsx-publish.js scripts pass filenames to execSync() as shell command strings. Prior to version 0.1.6, filenames containing shell metacharacters like $(cmd) could execute arbitrary commands. Note: This vulnerability exists only in the repository's development scripts. The published VSCode extension does not include these files and end users are not affected. This is fixed in version 0.1.6 by replacing execSync with execFileSync using array arguments. As a workaround, ensure .vsix files in the project directory have safe filenames before running publish scripts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-29T21:37:02.791Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25046", "state": "PUBLISHED", "dateUpdated": "2026-02-02T16:35:37.121Z", "dateReserved": "2026-01-28T14:50:47.886Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-29T21:37:02.791Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kimi-agent-sdk", "vendor": "MoonshotAI", "versions": [{"status": "affected", "version": "< 0.1.6"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kimi Agent SDK is a set of libraries that expose the Kimi Code (Kimi CLI) agent runtime in applications. The vsix-publish.js and ovsx-publish.js scripts pass filenames to execSync() as shell command strings. Prior to version 0.1.6, filenames containing shell metacharacters like $(cmd) could execute arbitrary commands. Note: This vulnerability exists only in the repository's development scripts. The published VSCode extension does not include these files and end users are not affected. This is fixed in version 0.1.6 by replacing execSync with execFileSync using array arguments. As a workaround, ensure .vsix files in the project directory have safe filenames before running publish scripts."}, {"lang": "es", "value": "Kimi Agent SDK es un conjunto de librer\u00edas que exponen el tiempo de ejecuci\u00f3n del agente Kimi Code (Kimi CLI) en aplicaciones. Los scripts vsix-publish.js y ovsx-publish.js pasan nombres de archivo a execSync() como cadenas de comandos de shell. Antes de la versi\u00f3n 0.1.6, los nombres de archivo que conten\u00edan metacaracteres de shell como $(cmd) pod\u00edan ejecutar comandos arbitrarios. Nota: Esta vulnerabilidad existe solo en los scripts de desarrollo del repositorio. La extensi\u00f3n de VSCode publicada no incluye estos archivos y los usuarios finales no se ven afectados. Esto se corrige en la versi\u00f3n 0.1.6 reemplazando execSync por execFileSync usando argumentos de matriz. Como soluci\u00f3n alternativa, aseg\u00farese de que los archivos .vsix en el directorio del proyecto tengan nombres de archivo seguros antes de ejecutar los scripts de publicaci\u00f3n."}], "id": "CVE-2026-25046", "lastModified": "2026-06-17T10:24:02.183", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.3, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25046", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-30T14:38:25.647378Z", "version": "2.0.3"}}]}, "published": "2026-01-29T22:15:55.493", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/MoonshotAI/kimi-agent-sdk/security/advisories/GHSA-mv58-gxx5-8hj3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:18:29.654866+00:00", "value": {"mitigation_remediation": ["Upgrade the Kimi Agent SDK to version 0.1.6 or later, which replaces execSync with execFileSync and removes the injection vector.", "If an upgrade cannot be performed immediately, ensure that all .vsix filenames in the project directory contain no shell metacharacters before invoking the publish scripts.", "Consider implementing a naming convention or automatic scan that rejects filenames with shell metacharacters to prevent accidental injection during future builds."], "summary": {"action": "Immediate Patch", "impact": "Command Injection"}, "threat_synthesis": {"affected_systems": "MoonshotAI\u2019s Kimi Agent SDK is vulnerable in all releases before 0.1.6, particularly versions that still expose the aforementioned scripts. The fix is provided in version 0.1.6 onwards, where execSync has been replaced with execFileSync and the invocation is safely passed as an array argument.", "description_and_impact": "The vulnerability exists in the Kimi Agent SDK\u2019s development scripts, vsix-publish.js and ovsx-publish.js, where filenames are passed directly to execSync as shell commands. This allows a malicious filename containing shell metacharacters (e.g., $(cmd)) to cause arbitrary commands to be executed during script run time. The weakness is a classic command injection flaw, classified as CWE-77. The impact is limited to developers executing these publish scripts; normal end\u2011user installation of the published VSCode extension is not affected.", "risk_and_exploitability": "The assessed CVSS score is 2.9, reflecting low severity. The EPSS score is below 1\u202f%, indicating a very low probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Exploitation requires a developer to run the publish scripts with specially crafted filenames, so the attack vector is local and depends on the developer\u2019s environment. In practice, this limits the real\u2011world risk, but the flaw is still a security concern for code\u2011base integrity."}}}}, "created": "2026-01-30T08:42:22.618704+00:00", "updated": "2026-04-18T01:30:16.032468+00:00", "vendors": ["moonshotai", "moonshotai$PRODUCT$kimi-agent-sdk"]}