CVE-2026-25046

{"id": "CVE-2026-25046", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 0.3}]}, "published": "2026-01-29T22:15:55.493", "references": [{"url": "https://github.com/MoonshotAI/kimi-agent-sdk/security/advisories/GHSA-mv58-gxx5-8hj3", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "Kimi Agent SDK is a set of libraries that expose the Kimi Code (Kimi CLI) agent runtime in applications. The vsix-publish.js and ovsx-publish.js scripts pass filenames to execSync() as shell command strings. Prior to version 0.1.6, filenames containing shell metacharacters like $(cmd) could execute arbitrary commands. Note: This vulnerability exists only in the repository's development scripts. The published VSCode extension does not include these files and end users are not affected. This is fixed in version 0.1.6 by replacing execSync with execFileSync using array arguments. As a workaround, ensure .vsix files in the project directory have safe filenames before running publish scripts."}, {"lang": "es", "value": "Kimi Agent SDK es un conjunto de bibliotecas que exponen el tiempo de ejecuci\u00f3n del agente Kimi Code (Kimi CLI) en aplicaciones. Los scripts vsix-publish.js y ovsx-publish.js pasan nombres de archivo a execSync() como cadenas de comandos de shell. Antes de la versi\u00f3n 0.1.6, los nombres de archivo que conten\u00edan metacaracteres de shell como $(cmd) pod\u00edan ejecutar comandos arbitrarios. Nota: Esta vulnerabilidad existe solo en los scripts de desarrollo del repositorio. La extensi\u00f3n de VSCode publicada no incluye estos archivos y los usuarios finales no se ven afectados. Esto se corrige en la versi\u00f3n 0.1.6 reemplazando execSync por execFileSync usando argumentos de matriz. Como soluci\u00f3n alternativa, aseg\u00farese de que los archivos .vsix en el directorio del proyecto tengan nombres de archivo seguros antes de ejecutar los scripts de publicaci\u00f3n."}], "lastModified": "2026-02-04T16:34:21.763", "sourceIdentifier": "security-advisories@github.com"}