Cross-Site Scripting in Kimi AI v1.0 Preview Feature

Successful exploitation results in arbitrary JavaScript execution in the victim user's browser session within the Kimi AI application origin. This can enable session theft, DOM manipulation, unauthorized actions on behalf of the user, access to data visible to the application in that session, phishing-style UI redressing, and potentially further compromise depending on available browser-side tokens, application privileges, and exposed functionality.

Until a fix is deployed, disable the Preview feature or force it to display generated output as plain text rather than rendered HTML. If disabling is not possible, deploy a strict Content Security Policy to reduce script execution paths, prohibit inline script where feasible, and restrict script sources. Treat all AI-generated output as untrusted input, and avoid previewing content from untrusted prompts or shared/generated artifacts in privileged sessions. Additional browser-side hardening such as HttpOnly/SameSite cookies may reduce post-exploitation impact but does not eliminate the underlying XSS condition.

Update the Preview rendering logic so untrusted AI-generated output is never inserted into the DOM as active HTML without strict sanitization. Render generated code/content as inert text by default, or apply robust allowlist-based HTML sanitization and context-appropriate output encoding before display. Remove or restrict dangerous elements and attributes such as <script>, event handlers, javascript: URLs, inline SVG/script-capable content, and other active content vectors. Review all client-side code paths that transform model output into rendered HTML and add regression tests covering XSS payloads in previewed content.