Vulnerabilities - Kimi Code - Visual Studio Code | ReversingLabs Spectra Assure Community

List of known vulnerabilities affecting the software package and the components it embeds. Last refreshed on: 2026/04/20

All detected vulnerabilities are fixable

Run the update/upgrade command in your package manager to resolve the detected vulnerabilities

CVSS Score

CVE Identifier

Summary

Tags

high

8.9

CVE-2026-25990

Pillow is vulnerable to an out-of-bounds write when loading a specially crafted PSD image.

Fix Available

high

8.2

CVE-2026-26007

Cryptography's public_key_from_numbers, EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify the point belongs to the expected prime-order subgroup of the curve.

Fix Available

high

7.6

CVE-2025-66416

MCP Python SDK does not enable DNS rebinding protection by default, allowing malicious websites to bypass same-origin policy restrictions.

Fix Available

high

7.5

CVE-2024-39689

Certifi removes root certificates from GLOBALTRUST due to unresolved compliance issues.

Fix Available

medium

6.3

CVE-2025-66221

Werkzeug's safe_join function allows path segments with Windows device names, leading to potential denial of service or information exposure.

Fix Available

medium

6.3

CVE-2026-21860

Werkzeug's safe_join function allows Windows special device names with compound extensions, leading to potential denial of service or information exposure.

Fix Available

medium

6.3

CVE-2026-27199

Werkzeug's safe_join function allows Windows special device names, potentially leading to denial of service or information exposure.

Exploits Exist

Fix Available

medium

5.4

CVE-2025-62801

FastMCP is vulnerable to OS command injection via the server_name field, allowing arbitrary commands on Windows hosts.

Exploits Exist

Fix Available

medium

5.3

CVE-2025-62800

FastMCP has a reflected cross-site scripting vulnerability in the OAuth client callback page.

Exploits Exist

Fix Available

low

2.0

CVE-2023-24816

IPython is vulnerable to command injection via the set_term_title function under specific conditions.

Vulnerability Triaged

Exploits Exist

Fix Available

Kimi Code

SAFE Assessment

Compliance

Security

Threats

INCIDENTS FOR THIS VERSION:

Did you know...

Kimi Code

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: This package had 8 removal incidents in versions published within 2 years prior to the latestLatest version with removal incident detected: 3 months agoVersion: 0.0.9

INCIDENTS FOR THIS VERSION:

Did you know...