What happened
CVE-2026-95660 (NVD, published 9/23-adjacent; CVSS 6.3) describes OS command injection in the MCP configuration loader of Kimi Code ≤0.31.0: loading a workspace .mcp.json spawns MCP servers with no trust prompt, so opening a repo is command injection. NVD notes a public exploit exists; the fix is in 0.31.1 which adds a prompt and hardens path handling.
Why it matters
Coding agents treat MCP config as data, but it is executable: a single untrusted repo, shared via PR/forum/issue attachment, can run arbitrary commands on the developer's workstation or CI that invokes the agent — with access to the same secrets the agent holds. This is the same auto-execution class as the GitSpawn findings in other agents (Claude Code, Codex, Cursor).
Attack vector
A malicious repository ships an MCP server definition in .mcp.json; when the agent loads the config it spawns the configured server command without a trust prompt, giving the repo author command execution on the victim's machine. The 0.31.1 fix adds a trust prompt and resolves fd/stty to absolute paths so the workspace cannot plant bare-name executables on $PATH.
Affected systems
Moonshot AI Kimi Code ≤ 0.31.0 (agent-core-v2/src/agent/mcp/config-loader.ts MCP configuration loader); fixed in 0.31.1
Mitigation
Upgrade Kimi Code to 0.31.1+; confirm which build you have after the kimi-cli→Kimi Code installer migration; do not open untrusted repos in the agent until the trust prompt is confirmed; treat .mcp.json in repos as executable content.