What is CVE-2026-17534?
Kimi Code library versions before 0.27.0 implement SSRF hardening for the FetchURL function using a static denylist in `assertSafeFetchTarget`, but fail to resolve DNS or re-validate hosts after HTTP redirects. This vulnerability allows an attacker who can influence a FetchURL call (e.g., via prompt injection) to gain unauthorized access to internal resources. Users should upgrade to version 0.27.0.
Azərbaycanca: Kimi Code kitabxanasının 0.27.0-dan əvvəlki versiyalarında FetchURL funksiyası SSRF (Server-Side Request Forgery) mühafizəsini statik denylist ilə həyata keçirir, lakin DNS həlli və HTTP redirect-lərdən sonra host yoxlanışı aparmır. Bu zəiflik prompt injection yolu ilə FetchURL çağırışına təsir edə bilən şəxsə daxili resurslara icazəsiz giriş imkanı yaradır. Kimi Code istifadəçiləri 0.27.0 versiyasına yeniləmə aparmalıdır.
Related CVEs
link basis: same weakness class CWE-918
FAQ2
Why does the CVE-2026-17534 vulnerability occur in the Kimi Code library?
This vulnerability occurs because the FetchURL function implements SSRF hardening using only a static denylist, but does not re-validate the host after DNS resolution and HTTP redirects.
What does an attacker need to do to exploit CVE-2026-17534?
An attacker needs to be able to influence a FetchURL call, for example via prompt injection.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.