CVE-2026-79294

Published Sep 18, 2026·Updated Sep 18, 2026

NVD Description

Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component

Public Exploits & PoCs1 found

[POC] MAL-2025-6022 — CVE-2026-79294

CVE-2026-79294 — Stored XSS in Moonshot AI Kimi's HTML artifact Preview, delivered through the public Share view, leading to session token exfiltration and demonstrated account takeover. Responsible disclosure advisory.

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free