{"id":"CVE-2026-79294","aliases":["EUVD-2026-82973","GHSA-4mwh-5hjw-p5jv"],"status":"published","title":"Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote...","description":"Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00506,"percentile":0.43685,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2026-09-18T00:00:00Z","modified":"2026-09-22T20:00:03Z","exploits":[{"source":"pocgithub","id":"MGTx2/CVE-2026-79294","title":"MGTx2/CVE-2026-79294","date":"2026-09-11","url":"https://github.com/MGTx2/CVE-2026-79294"}],"references":[{"url":"http://kimi.com"},{"url":"http://moonshot.com"},{"url":"https://kimi.com/share/"},{"url":"https://github.com/MGTx2/CVE-2026-79294/blob/main/README.md","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79294"},{"url":"https://kimi.com/share"},{"url":"https://github.com/advisories/GHSA-4mwh-5hjw-p5jv"}],"sources":{"cve":[{"id":"CVE-2026-79294","description":"Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component","status":"published","published":"2026-09-18T00:00:00Z","modified":"2026-09-18T15:01:08.894Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:50:38.739766Z"}],"euvd":[{"id":"EUVD-2026-82973","description":"Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component","status":"published","published":"2026-09-18T00:00:00Z","modified":"2026-09-18T15:01:08Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:08.412343Z"}],"ghsa":[{"id":"GHSA-4mwh-5hjw-p5jv","title":"Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote...","description":"Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component","status":"published","published":"2026-09-18T15:32:17Z","modified":"2026-09-18T18:31:48Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:12:11.358904Z"}],"nvd":[{"id":"CVE-2026-79294","description":"Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component","status":"published","published":"2026-09-18T14:18:48.077Z","modified":"2026-09-22T20:00:03.713Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:49.70655Z"}]}}