A critical remote command injection vulnerability in Moonshot AI Kimi Code allows unauthenticated attackers to execute arbitrary OS commands, posing a severe risk to development environments.

This vulnerability is an OS command injection flaw located in the agent-core-v2/src/agent/mcp/config-loader.ts file. Unauthenticated attackers can exploit this by utilizing project-scoped configuration files to trigger unauthorized code execution during the auto-spawn process.

Successful exploitation allows an attacker to gain unauthorized control over the host environment where Kimi Code is running. Given the CVSS score of 6.3, the risk of data exfiltration, lateral movement, or the permanent compromise of development workstations is significant. Organizations rely on these tools for secure coding, and this flaw undermines the integrity of the entire software development lifecycle.

Immediate Action: Update Moonshot AI Kimi Code to version 0.31.1 or later immediately to incorporate the necessary path validation and command execution safeguards.

Proactive Monitoring: Review environment logs for suspicious process spawns related to the MCP Configuration Loader and monitor for unauthorized modifications to .mcp.json files within workspaces.

Compensating Controls: Restrict access to untrusted workspaces and ensure that developer environments are isolated from sensitive production networks to limit the impact of potential command execution.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the researcher.

The presence of a public proof-of-concept combined with the nature of command injection makes this a high-priority remediation task. Security teams must enforce the immediate update to version 0.31.1 to neutralize the risk of unauthorized command execution. Failure to patch will leave development environments exposed to remote attackers capable of compromising sensitive source code or credentials stored within the workspace.