VulnSocial

CVE-2026-39107Disclosure

LOWCVSS 6.3 · MEDIUM

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

A Cross Site Scripting vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. The application fails to properly sanitize or encode HTML/JavaScript payloads generated by the AI model. When a user switches to the 'Preview' tab to view AI-generated code, the malicious payload is rendered directly into the DOM, leading to arbitrary JavaScript execution in the victim's browser session.

Back to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Threat summary

  • Public PoC is present in monitored signal
  • 4 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-08-02)
  • 4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d
01122Mentions · 2026-06-04: 1Mentions · 2026-06-09: 1Mentions · 2026-08-02: 2PoC Mentioned / Linked · 2026-08-02: 1Technical Details · 2026-06-04: 1Technical Details · 2026-08-02: 206-0406-0908-02
Signal classification3 categories
Disclosure
250.0%
General
125.0%
PoC
125.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-06-041
Disclosure1
2026-06-091
General1
2026-08-022
Disclosure1PoC1
Full discourse4 posts
  • Israel@f1tym1
    Disclosure

    CVE-2026-39107 in Kimi AI allows stored XSS attacks via maliciously crafted prompts, exposing AI-generated code as an attack vector. https://ift.tt/Hoqtr2V

    Post summary

    The text reports a stored XSS vulnerability (CVE-2026-39107) in Kimi AI that can be exploited through malicious prompt crafting, without mentioning patches, PoC, or active exploitation.

    0001071
    1.0K followersView on X
  • UNDERCODE TESTING@UndercodeUpdate
    PoC

    🚨 #CVE-2026-39107: Kimi #AI's Stored XSS Flaw — When #AI-Generated Code Becomes an Attack Vector + Video https://undercodetesting.com/cve-2026-39107-kimi-ais-stored-xss-flaw-when-ai-generated-code-becomes-an-attack-vector-video/ Educational Purposes!

    Post summary

    The post announces a stored XSS vulnerability in Kimi AI and showcases a video PoC, but does not provide active exploitation evidence or patch information.

    0000065
    678 followersView on X
  • مجلة طموحIT@itambition1iq
    General

    الثغرة المسجلة رسميًا تحت الرقم CVE-2026-39107 وقد وثقت الثغرة رسميًا ضمن قاعدة بيانات الثغرات العالمية CVE وقاعدة NVD التابعة للمعهد الوطني الأمريكي للمعايير والتكنولوجيا NIST، بدرجة خطورة بلغت 6.3 من 10 https://www.cve.org/CVERecord?id=CVE-2026-39107 https://nvd.nist.gov/vuln/detail/CVE-2026-39107 https://t.co/YEppVovXob

    Post summary

    Announcement of CVE‑2026‑39107 with a CVSS score of 6.3; no additional technical, exploit, or patch information provided.

    0000030
    102 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-39107 Cross Site Scripting Vulnerability in Kimi AI v1.0 Preview Feature https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-39107

    Post summary

    The post announces the existence of an XSS flaw (CVE‑2026‑39107) in Kimi AI v1.0, but does not provide any PoC, exploit, active attack evidence, or patch details.

    0000057
    4.0K followersView on X

Explore more

Back to dashboard