{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-126757","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2026-11-11T16:58:28.007Z","datePublished":"2026-11-11T22:45:40.168Z","dateUpdated":"2026-11-11T22:45:40.168Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-11-11T22:45:40.168Z"},"title":"Moonshot AI Kimi Code Web UI index-HU0LCM-X.js isOriginAllowed redirect","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-601","lang":"en","description":"Open Redirect"}]}],"affected":[{"vendor":"Moonshot AI","product":"Kimi Code","versions":[{"version":"2.5.0","status":"affected"},{"version":"2.5.1","status":"affected"},{"version":"2.5.2","status":"affected"}],"cpes":["cpe:2.3:a:moonshot_ai:kimi_code:*:*:*:*:*:*:*:*"],"modules":["Web UI"]}],"descriptions":[{"lang":"en","value":"A security vulnerability has been detected in Moonshot AI Kimi Code up to 2.5.2. This affects the function isOriginAllowed of the file apps/kimi-code/dist-web/assets/index-HU0LCM-X.js of the component Web UI. Such manipulation of the argument kimi_origin leads to open redirect. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C"}}],"timeline":[{"time":"2026-11-11T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-11-11T01:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-11-11T18:03:39.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"ShiyuFan_BinYuan (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}],"references":[{"url":"https://vuldb.com/vuln/435867","name":"VDB-435867 | Moonshot AI Kimi Code Web UI index-HU0LCM-X.js isOriginAllowed redirect","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/435867/cti","name":"VDB-435867 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-126757","name":"CVE-2026-126757 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/1033259","name":"Submit #1033259 | 北京月之暗面科技股份有限公司 kimi code 0.42.0 Kimi Code 默认配置RCE 无需开启危险模式","tags":["third-party-advisory"]},{"url":"https://mcniyfj5bw9b.feishu.cn/docx/IZ43dY0wzoDtnUxGgy7cQ6xcnFh","tags":["exploit"]}],"x_generator":["VulDB PVTS v202611"]}}}