What happened
CVE-2026-126758: the .kimi-code/local.toml component relies on the untrusted additional_dir argument in a security decision, so a repository-supplied config can affect workspace directory handling in the AI coding agent.
Why it matters
An AI coding agent trusts repository-local config; a malicious repo can steer which paths the agent treats as in-workspace, enabling operations outside the expected directory (data access/overwrite).
Attack vector
The WorkspaceDirsService reads additional_dir from a repository-local .kimi-code/local.toml configuration and uses it in a security decision (workspace containment), allowing a crafted repository config to influence which directories are treated as workspace.
Affected systems
MoonshotAI kimi-code <= 2.0.2 (.kimi-code/local.toml)
Mitigation
Upgrade to kimi-code 2.1.0+; validate repository-supplied local.toml and treat it as untrusted; enforce workspace allowlist.