Kimi Code FetchURL SSRF protection bypass vulnerability

JFrog Security Research disclosed that FetchURL in Kimi Code (@moonshot-ai/kimi-code) before version 0.27.0 has an SSRF protection bypass vulnerability CVE-2026-17534, CVSS 5.5. The implementation only performs static hostname and IP literal blacklisting in assertSafeFetchTarget, does not resolve DNS, and does not re-validate the host after HTTP redirects. An attacker who can influence FetchURL calls (e.g., via prompt injection) can provide a public hostname that resolves to loopback or internal addresses, or use a public URL that redirects to such targets, thereby accessing internal services that the blacklist was supposed to block. Since FetchURL is part of the default auto-approved toolset, no user interaction confirmation is required in manual mode.