Kimi Code is vulnerable to a FetchURL SSRF Protection Bypass via DNS-resolving Hostnames and Redirects

Moonshot AI's Kimi Code, a coding agent, is vulnerable to a FetchURL SSRF protection bypass in versions before 0.27.0, allowing attackers to reach internal network services via DNS-resolving hostnames or redirects. The flaw stems from a static denylist that fails to resolve DNS or revalidate after redirects, and FetchURL is in the default auto-approve tool set. The fix in version 0.27.0 adds DNS resolution, per-hop redirect validation, and connection pinning.

Summary summary Kimi Code is vulnerable to a FetchURL SSRF Protection Bypass via DNS-resolving Hostnames and Redirects Component component @moonshot-ai/kimi-code Kimi Code Affected versions affected-versions < 0.27.0 Description description Kimi Code implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after HTTP redirects. An attacker who can influence a FetchURL call, for example via prompt injection, can supply a crafted public hostname that resolves to loopback or another internal address, or a public URL that redirects to such a target, and thereby reach internal network services that the denylist was intended to block. FetchURL is included in the default auto-approve tool set, so the call does not require interactive user confirmation in manual mode. PoC poc Step 1 - Start a local HTTP listener python3 -m http.server 1337 --bind 127.0.0.1 Step 2 - Confirm the literal denylist blocks localhost Ask the agent to use FetchURL on http://localhost:1337 or http://127.0.0.1:1337 . Expected result: the request is denied by assertSafeFetchTarget for example, "Refusing to fetch private host" . Step 3 - Bypass via a DNS-resolving hostname Ask the agent to use FetchURL on a public hostname whose DNS resolves to loopback, for example http://localtest.me:1337 . Step 4 - Verify the request reaches the local listener Watch the simple HTTP server console. A GET request arrives from the Kimi Code process, demonstrating that DNS-resolving names are not validated against private address ranges. The same class of bypass applies to public URLs that HTTP-redirect to loopback or internal targets, because redirects were followed without re-running the safety check on each hop. Vulnerability Mitigations vulnerability-mitigations Upgrade to Kimi Code 0.27.0 or later. The fix resolves hostnames via DNS and rejects addresses in loopback, RFC1918, link-local, CGNAT, and ULA ranges; follows redirects manually with per-hop revalidation; and pins connections to the validated resolved addresses to reduce DNS-rebinding TOCTOU races. References references https://github.com/MoonshotAI/kimi-code/pull/1791 https://github.com/MoonshotAI/kimi-code/pull/1791 https://github.com/MoonshotAI/kimi-code/commit/31449728b72df94e22bcb2de350a1e7624895e30 https://github.com/MoonshotAI/kimi-code/commit/31449728b72df94e22bcb2de350a1e7624895e30 https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%400.27.0 https://github.com/MoonshotAI/kimi-code/releases/tag/%40moonshot-ai%2Fkimi-code%400.27.0