PT-2026-5361 · Microsoft+1 · Vscode+1

Hackerman70000 · Publicado 2026-01-29 · Atualizado 2026-03-03 · CVE-2026-25046

Positive Technologies (AI Summary)

CVSS v3.1

2.9

Baixa

Vetor base

AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kimi Agent SDK versions prior to 0.1.6

Description The Kimi Agent SDK libraries expose the Kimi Code agent runtime in applications. The vsix-publish.js and ovsx-publish.js scripts pass filenames to the execSync() function as shell command strings. Filenames containing shell metacharacters, such as $(cmd), could potentially execute arbitrary commands. This issue is present only in the repository’s development scripts and does not affect published VSCode extensions. The scripts utilize the execSync() function with filenames as arguments, which allows for command injection.

Recommendations Update to version 0.1.6 or later, which replaces execSync with execFileSync using array arguments. Ensure .vsix files in the project directory have safe filenames before running publish scripts.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2026-25046

GHSA-MV58-GXX5-8HJ3

Produtos afetados

Kimi-Agent-Sdk

Vscode

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25046.json · Exploit
• https://github.com/MoonshotAI/kimi-agent-sdk/security/advisories/GHSA-mv58-gxx5-8hj3 · Nota
• https://twitter.com/CVEnew/status/2017000654309302761 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2017075612100215151 · Publicação no Twitter
• https://twitter.com/guava_asi/status/2028968557875524026 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-25046 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-25046 · Aviso do Fabricante