CVE-2026-39107: Kimi AI v1.0 Cross-Site Scripting in Preview Feature

Technical summary

CVE-2026-39107 is a stored or reflected cross-site scripting flaw (CWE-79) in the Kimi AI v1.0 Preview interface. The vulnerability stems from insufficient HTML/JavaScript encoding when rendering AI model outputs to the DOM. An attacker can craft prompts that cause the AI to generate payloads containing unescaped script tags or event handlers. When a victim previews the generated code, the browser executes the injected JavaScript in the user's security context, bypassing the application's intended sandbox or preview isolation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) reflects network attack surface, low attack complexity, no privilege requirement, but mandatory user interaction to trigger.

Business impact

An attacker leveraging this XSS can impersonate users within the Kimi AI application, access sensitive information visible to the victim's account, modify or delete user data, redirect users to phishing sites, or install malware. In a multi-tenant or enterprise deployment, lateral movement may be possible if the application shares authentication tokens or session state. The reliance on AI-generated code preview suggests developers and technical users are the primary targets, potentially exposing intellectual property or development practices.

Affected systems

Kimi AI v1.0 web interface, specifically the Preview feature used to display AI-generated code. The vulnerability affects all installations and users of this version that access the Preview tab with untrusted or attacker-controlled AI prompts.

Exploitability

Exploitation requires user interaction—a victim must navigate to the Preview tab to render the malicious payload. No authentication bypass or privilege escalation is needed; any user can trigger the XSS. The attack surface is broad (network-accessible) and attack complexity is low. Proof-of-concept is straightforward: inject a prompt containing script tags or event handlers and wait for the victim to preview. The vulnerability is likely trivial to exploit at scale if AI output is not validated.

Remediation

Implement strict output encoding: HTML-encode all AI-generated content before insertion into the DOM, or use textContent instead of innerHTML for dynamic content. Validate and sanitize AI responses server-side prior to storage or transmission. Employ a Content Security Policy (CSP) to restrict inline script execution and limit damage from any XSS that escapes sanitization. Consider a sandboxed iframe for code preview to isolate execution context. Apply input validation on user prompts to reject or neutralize known malicious patterns before feeding them to the AI model.

Patch guidance

Verify the availability of a patched version from the Kimi AI vendor. Check the vendor's security advisory or release notes for v1.0.1 or later that addresses XSS output sanitization in the Preview feature. If no patch is available, request an ETA from the vendor and implement compensating controls (see remediation). Test patches in a non-production environment before deployment to ensure no regression in code preview functionality.

Detection guidance

Monitor for unusual JavaScript patterns in AI-generated code outputs: script tags, event handlers (onload, onerror, onclick), or encoded payloads. Log access to the Preview feature and correlate with suspicious user behavior or anomalous account activity. Use browser developer tools or proxy logs to inspect DOM mutations in the Preview tab. Implement server-side validation logging to flag AI responses containing high-risk HTML/JavaScript constructs. Endpoint detection and response (EDR) tools may detect process spawning or credential access following XSS execution, though XSS often operates silently for session hijacking.

Why prioritize this

Although scored MEDIUM (6.3), this vulnerability merits prompt attention due to user interaction being the only barrier to exploitation and the direct exposure of user sessions. XSS in a code preview tool targets technical users who may have elevated privileges, broader access, or valuable intellectual property. The lack of CISA KEV status does not diminish urgency; active exploitation may not yet be documented. Prioritize if Kimi AI is used for sensitive or proprietary code generation.

Risk score, explained

CVSS 3.1 score of 6.3 (MEDIUM) reflects: network accessibility (AV:N), straightforward attack requiring minimal precondition (AC:L), no privilege requirement (PR:N), but mandatory user interaction (UI:R) to navigate to Preview. Impact is limited to confidentiality, integrity, and availability at the user-session level (S:U, C:L, I:L, A:L)—no system-wide compromise. The score appropriately captures the practical risk: high likelihood of exploitation if an attacker controls prompt input, but confined to individual user sessions rather than server-side compromise.

Frequently asked questions