Summary Kimi Code is vulnerable to a FetchURL SSRF Protection Bypass via DNS-resolving Hostnames and Redirects
[Component](#component)
@moonshot-ai/kimi-code (Kimi Code)
[Affected versions](#affected-versions)
< 0.27.0
Description Kimi Code implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call, for example via prompt injection, can supply a crafted public hostname that resolves to loopback or another internal address, or a public URL that redirects to such a target, and thereby reach internal network services that the denylist was intended to block. FetchURL is included in the default auto-approve tool set, so the call does not require interactive user confirmation in manual mode.
PoC Step 1 - Start a local HTTP listener
python3 -m http.server 1337 --bind 127.0.0.1
Step 2 - Confirm the literal denylist blocks localhost
Ask the agent to use FetchURL on http://localhost:1337
(or http://127.0.0.1:1337
).
Expected result: the request is denied by assertSafeFetchTarget (for example, "Refusing to fetch private host").
Step 3 - Bypass via a DNS-resolving hostname
Ask the agent to use FetchURL on a public hostname whose DNS resolves to loopback, for example http://localtest.me:1337
.
Step 4 - Verify the request reaches the local listener
Watch the simple HTTP server console. A GET request arrives from the Kimi Code process, demonstrating that DNS-resolving names are not validated against private address ranges.
The same class of bypass applies to public URLs that HTTP-redirect to loopback or internal targets, because redirects were followed without re-running the safety check on each hop.
Vulnerability Mitigations Upgrade to Kimi Code 0.27.0 or later. The fix resolves hostnames via DNS and rejects addresses in loopback, RFC1918, link-local, CGNAT, and ULA ranges; follows redirects manually with per-hop revalidation; and pins connections to the validated resolved addresses to reduce DNS-rebinding (TOCTOU) races.
[References](#references)
[https://github.com/MoonshotAI/kimi-code/pull/1791](https://github.com/MoonshotAI/kimi-code/pull/1791)
https://github.com/MoonshotAI/kimi-code/commit/31449728b72df94e22bcb2de350a1e7624895e30 https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%400.27.0