{"name":"kimi-cli","full_name":"kimi-cli","tap":"homebrew/core","oldnames":[],"aliases":[],"versioned_formulae":[],"desc":"CLI agent for MoonshotAI Kimi platform","license":"Apache-2.0","homepage":"https://moonshotai.github.io/kimi-cli/","versions":{"stable":"1.48.0","head":"HEAD","bottle":true},"urls":{"stable":{"url":"https://files.pythonhosted.org/packages/e9/a9/3d25e80362abb7345a5dd05dc47cdcdc627e8d810d027943cc4647dcdb03/kimi_cli-1.48.0.tar.gz","tag":null,"revision":null,"using":null,"checksum":"313061b4c757bba58ef9039a30be8bae6853513e608c059532c43f389d7252f8"},"head":{"url":"https://github.com/MoonshotAI/kimi-cli.git","branch":"main","using":null}},"patches":[],"revision":1,"version_scheme":0,"compatibility_version":null,"autobump":false,"no_autobump_message":"macOS resources cannot be updated on linux CI","skip_livecheck":false,"bottle":{"stable":{"rebuild":0,"root_url":"https://ghcr.io/v2/homebrew/core","files":{"arm64_golden_gate":{"cellar":":any","url":"https://ghcr.io/v2/homebrew/core/kimi-cli/blobs/sha256:ad4b3293a28e0d16b03240cd657cbfc4beebd4447af65b989f112e2476bac293","sha256":"ad4b3293a28e0d16b03240cd657cbfc4beebd4447af65b989f112e2476bac293"},"arm64_tahoe":{"cellar":":any","url":"https://ghcr.io/v2/homebrew/core/kimi-cli/blobs/sha256:05c426f8182298ff221b65d4db594957ad9e64371f346ba82fd85a707a117adb","sha256":"05c426f8182298ff221b65d4db594957ad9e64371f346ba82fd85a707a117adb"},"arm64_sequoia":{"cellar":":any","url":"https://ghcr.io/v2/homebrew/core/kimi-cli/blobs/sha256:ce121fb6512b066e7c2fa8e369e0071b6ef0657a716d22fb160c01f3b90d1bde","sha256":"ce121fb6512b066e7c2fa8e369e0071b6ef0657a716d22fb160c01f3b90d1bde"},"arm64_sonoma":{"cellar":":any","url":"https://ghcr.io/v2/homebrew/core/kimi-cli/blobs/sha256:bb5607d53504301cd267eb88f16c9ecb04d92d5dc4ace1469e18b46ea0559398","sha256":"bb5607d53504301cd267eb88f16c9ecb04d92d5dc4ace1469e18b46ea0559398"},"sonoma":{"cellar":":any","url":"https://ghcr.io/v2/homebrew/core/kimi-cli/blobs/sha256:d63ff3561cadf9c8102ddc98914a5360d008dbcc4564f10891aa46ad3bce5653","sha256":"d63ff3561cadf9c8102ddc98914a5360d008dbcc4564f10891aa46ad3bce5653"},"arm64_linux":{"cellar":":any","url":"https://ghcr.io/v2/homebrew/core/kimi-cli/blobs/sha256:0f1d8f052e7fafc913c3308f2867c08adb98c823538cd85dfd5869280bef048e","sha256":"0f1d8f052e7fafc913c3308f2867c08adb98c823538cd85dfd5869280bef048e"},"x86_64_linux":{"cellar":":any","url":"https://ghcr.io/v2/homebrew/core/kimi-cli/blobs/sha256:02891606f6a923c14222216736e28151db7cb26cd7d063b627af438beb7cabc4","sha256":"02891606f6a923c14222216736e28151db7cb26cd7d063b627af438beb7cabc4"}}}},"pour_bottle_only_if":null,"keg_only":false,"keg_only_reason":null,"options":[],"build_dependencies":["pkgconf","pybind11","rust"],"dependencies":["certifi","cryptography","libyaml","pillow","pydantic","python@3.14","re2","rpds-py"],"test_dependencies":[],"recommended_dependencies":[],"optional_dependencies":[],"uses_from_macos":["libffi","libxml2","libxslt"],"uses_from_macos_bounds":[{},{"since":"ventura"},{}],"requirements":[],"conflicts_with":[],"conflicts_with_reasons":[],"link_overwrite":[],"caveats":null,"installed":[],"linked_keg":null,"pinned":false,"outdated":false,"deprecated":true,"deprecation_date":"2026-07-17","deprecation_reason":"deprecated_upstream","deprecation_replacement_formula":"kimi-code","deprecation_replacement_cask":null,"deprecate_args":{"date":"2026-07-17","because":"deprecated_upstream","replacement_formula":"kimi-code","replacement_cask":null},"disabled":false,"disable_date":"2027-01-17","disable_reason":null,"disable_replacement_formula":null,"disable_replacement_cask":null,"disable_args":{"date":"2027-01-17","because":"deprecated_upstream","replacement_formula":"kimi-code","replacement_cask":null},"post_install_steps":[],"post_install_defined":false,"service":null,"tap_git_head":"3580efd52d92c2e3c3da5b9c79553f6e88002426","ruby_source_path":"Formula/k/kimi-cli.rb","ruby_source_checksum":{"sha256":"fb2c4aafae90a1be3ae6baf78246badf726677873edd190cacbc3301ce2c27a3"},"variations":{},"executables":["kimi","kimi-cli"],"vulnerabilities":{"open":[{"id":"BREW-kimi-cli-CVE-2026-100689","upstream":["GHSA-59cr-6r3x-644w","CVE-2026-100689"],"summary":"GitPython submodule update path traversal can write outside the repository"},{"id":"BREW-kimi-cli-CVE-2026-101917","upstream":["GHSA-2gx3-rcp4-g85q","CVE-2026-101917","PYSEC-2026-4140"],"summary":"PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-101918","upstream":["GHSA-42vr-xj54-vc7v","CVE-2026-101918","PYSEC-2026-4141"],"summary":"PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-102265","upstream":["GHSA-8wjv-2p76-3863","CVE-2026-102265","PYSEC-2026-4142"],"summary":"PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-102266","upstream":["GHSA-9j54-fg26-wv3r","CVE-2026-102266","PYSEC-2026-4143"],"summary":"PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-102267","upstream":["GHSA-9v7f-9g4p-ffgj","CVE-2026-102267","PYSEC-2026-4144"],"summary":"PyJWT: PyJWKClient follows redirects when fetching JWKS","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-102268","upstream":["GHSA-ffc3-869f-jxw9","CVE-2026-102268","PYSEC-2026-4145"],"summary":"PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard","severity":"critical"},{"id":"BREW-kimi-cli-CVE-2026-102269","upstream":["GHSA-hxm8-2xgr-2p9m","CVE-2026-102269","PYSEC-2026-4147"],"summary":"PyJWT: Non-canonical signature segments enable raw-token revocation bypass","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-102270","upstream":["GHSA-jwrc-g2q2-pq5p","CVE-2026-102270","PYSEC-2026-4148"],"summary":"PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-102271","upstream":["GHSA-p4g4-x82p-q773","CVE-2026-102271","PYSEC-2026-4149"],"summary":"PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-102272","upstream":["GHSA-r6x4-923q-g947","CVE-2026-102272","PYSEC-2026-4150"],"summary":"PyJWT BOM Bypass","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-102273","upstream":["GHSA-w2cx-738m-mc7w","CVE-2026-102273","PYSEC-2026-4151"],"summary":"PyJWT accepts public JWK containers as HMAC secrets","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-102274","upstream":["GHSA-w6j9-cwv2-h6wq","CVE-2026-102274","PYSEC-2026-4152"],"summary":"PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-102275","upstream":["GHSA-x33g-cr3x-6449","CVE-2026-102275","PYSEC-2026-4183"],"summary":"PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-103001","upstream":["GHSA-gvp8-978c-rx2q","CVE-2026-103001","PYSEC-2026-4146"],"summary":"PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-104874","upstream":["GHSA-54p9-h82j-f925","CVE-2026-104874"],"summary":"Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-22815","upstream":["GHSA-w2fm-2cpv-w7v5","CVE-2026-22815","PYSEC-2026-2094"],"summary":"aiohttp allows unlimited trailer headers, leading to possible uncapped memory usage"},{"id":"BREW-kimi-cli-CVE-2026-34513","upstream":["GHSA-hcc4-c3v8-rx92","CVE-2026-34513","PYSEC-2026-2095"],"summary":"AIOHTTP Affected by Denial of Service (DoS) via Unbounded DNS Cache in TCPConnector"},{"id":"BREW-kimi-cli-CVE-2026-34514","upstream":["GHSA-2vrm-gr82-f7m5","CVE-2026-34514","PYSEC-2026-2096"],"summary":"AIOHTTP has CRLF injection through multipart part content type header construction"},{"id":"BREW-kimi-cli-CVE-2026-34515","upstream":["GHSA-p998-jp59-783m","CVE-2026-34515","PYSEC-2026-2097"],"summary":"AIOHTTP affected by UNC SSRF/NTLMv2 Credential Theft/Local File Read in static resource handler on Windows"},{"id":"BREW-kimi-cli-CVE-2026-34516","upstream":["GHSA-m5qp-6w8w-w647","CVE-2026-34516","PYSEC-2026-2098"],"summary":"AIOHTTP has a Multipart Header Size Bypass","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-34517","upstream":["GHSA-3wq7-rqq7-wx6j","CVE-2026-34517","PYSEC-2026-2099"],"summary":"AIOHTTP has late size enforcement for non-file multipart fields causes memory DoS"},{"id":"BREW-kimi-cli-CVE-2026-34518","upstream":["GHSA-966j-vmvw-g2g9","CVE-2026-34518","PYSEC-2026-2100"],"summary":"AIOHTTP leaks Cookie and Proxy-Authorization headers on cross-origin redirect","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-34519","upstream":["GHSA-mwh4-6h8g-pg8w","CVE-2026-34519","PYSEC-2026-2101"],"summary":"AIOHTTP has HTTP response splitting via \\r in reason phrase"},{"id":"BREW-kimi-cli-CVE-2026-34520","upstream":["GHSA-63hf-3vf5-4wqf","CVE-2026-34520","PYSEC-2026-2102"],"summary":"AIOHTTP's C parser (llhttp) accepts null bytes and control characters in response header values - header injection/security bypass","severity":"critical"},{"id":"BREW-kimi-cli-CVE-2026-34525","upstream":["GHSA-c427-h43c-vf67","CVE-2026-34525","PYSEC-2026-2103"],"summary":"AIOHTTP accepts duplicate Host headers"},{"id":"BREW-kimi-cli-CVE-2026-34993","upstream":["GHSA-jg22-mg44-37j8","CVE-2026-34993","PYSEC-2026-2104"],"summary":"AIOHTTP is Vulnerable to Deserialization of Untrusted Data","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-41066","upstream":["GHSA-vfmq-68hx-4jfw","CVE-2026-41066","PYSEC-2026-87"],"summary":"lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-47265","upstream":["GHSA-hg6j-4rv6-33pg","CVE-2026-47265","PYSEC-2026-2105"],"summary":"AIOHTTP is vulnerable to cross-origin redirect with per-request cookies"},{"id":"BREW-kimi-cli-CVE-2026-49825","upstream":["GHSA-4jhm-jv67-739f","CVE-2026-49825","PYSEC-2026-2614"],"summary":"`lxml_html_clean.Cleaner` does not strip `javascript:` URLs from namespaced URL attributes","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-50269","upstream":["GHSA-m6qw-4cw2-hm4m","CVE-2026-50269","PYSEC-2026-2106"],"summary":"aiohttp: CRLF injection in multipart headers"},{"id":"BREW-kimi-cli-CVE-2026-54273","upstream":["GHSA-4fvr-rgm6-gqmc","CVE-2026-54273","PYSEC-2026-2107"],"summary":"aiohttp: HTTP/1 Pipelined Requests Queue Without Limit"},{"id":"BREW-kimi-cli-CVE-2026-54274","upstream":["GHSA-xcgm-r5h9-7989","CVE-2026-54274","PYSEC-2026-2108"],"summary":"aiohttp: Incomplete websocket frame payloads bypass memory limits"},{"id":"BREW-kimi-cli-CVE-2026-54275","upstream":["GHSA-4m7w-qmgq-4wj5","CVE-2026-54275","PYSEC-2026-237"],"summary":"aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS Connections"},{"id":"BREW-kimi-cli-CVE-2026-54276","upstream":["GHSA-hpj7-wq8m-9hgp","CVE-2026-54276","PYSEC-2026-2109"],"summary":"aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect Challenges"},{"id":"BREW-kimi-cli-CVE-2026-54277","upstream":["GHSA-63hw-fmq6-xxg2","CVE-2026-54277","PYSEC-2026-2110"],"summary":"aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented Lines"},{"id":"BREW-kimi-cli-CVE-2026-54278","upstream":["GHSA-g3cq-j2xw-wf74","CVE-2026-54278","PYSEC-2026-2111"],"summary":"aiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup"},{"id":"BREW-kimi-cli-CVE-2026-54279","upstream":["GHSA-2fqr-mr3j-6wp8","CVE-2026-54279","PYSEC-2026-2112"],"summary":"aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence"},{"id":"BREW-kimi-cli-CVE-2026-54280","upstream":["GHSA-9x8q-7h8h-wcw9","CVE-2026-54280","PYSEC-2026-2113"],"summary":"aiohttp: Payload Response Resources Are Not Closed After Mid-Body Disconnect"},{"id":"BREW-kimi-cli-CVE-2026-54590","upstream":["GHSA-qr67-gv47-xwwh","CVE-2026-54590","PYSEC-2026-3809"],"summary":"asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-54591","upstream":["GHSA-2wxc-x7rj-hg8f","CVE-2026-54591","PYSEC-2026-3808"],"summary":"asyncssh has SCP Path Traversal to Arbitrary File Write","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-59881","upstream":["GHSA-mq44-7p77-q5h7","CVE-2026-59881","PYSEC-2026-3547"],"summary":"AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate"},{"id":"BREW-kimi-cli-CVE-2026-62949","upstream":["GHSA-rw4j-r22c-9gc3","CVE-2026-62949","PYSEC-2026-4026"],"summary":"AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-69097","upstream":["GHSA-3rp5-jjmw-4wv2","CVE-2026-69097","PYSEC-2026-3981"],"summary":"GitPython: git-config section-name injection enables arbitrary config directives (core.sshCommand RCE)","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-69243","upstream":["GHSA-mfx4-hv73-q22v","CVE-2026-69243","PYSEC-2026-3546"],"summary":"AIOHTTP: HTTP request smuggling via WebSocket upgrade"},{"id":"BREW-kimi-cli-CVE-2026-69244","upstream":["GHSA-cq5v-8q36-5273","CVE-2026-69244","PYSEC-2026-3545"],"summary":"AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)"},{"id":"BREW-kimi-cli-CVE-2026-73619","upstream":["GHSA-539m-9xh6-q6rr","CVE-2026-73619","PYSEC-2026-3948"],"summary":"GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-73620","upstream":["GHSA-3f7w-8rr8-f37f","CVE-2026-73620","PYSEC-2026-3949"],"summary":"GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-73621","upstream":["GHSA-p538-c434-8v24","CVE-2026-73621","PYSEC-2026-3950"],"summary":"GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-73622","upstream":["GHSA-94p4-4cq8-9g67","CVE-2026-73622","PYSEC-2026-3951"],"summary":"GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-73623","upstream":["GHSA-6p8h-3wgx-97gf","CVE-2026-73623","PYSEC-2026-3952"],"summary":"GitPython: Incomplete unsafe_git_clone_options denylist omits --template enabling arbitrary command execution via clone hooks","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-73624","upstream":["GHSA-fjr4-x663-mwxc","CVE-2026-73624","PYSEC-2026-3995"],"summary":"GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-73625","upstream":["GHSA-r9mr-m37c-5fr3","CVE-2026-73625","PYSEC-2026-3953"],"summary":"GitPython: Unsafe git option guard bypass via single-character kwarg value token smuggling enables arbitrary command execution","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-76217","upstream":["GHSA-hh9p-6wh2-4mfc","CVE-2026-76217","PYSEC-2026-3841"],"summary":"GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-76218","upstream":["GHSA-9rj7-rf2p-w77r","CVE-2026-76218","PYSEC-2026-3840"],"summary":"GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-76219","upstream":["GHSA-4gmw-gg2m-w46p","CVE-2026-76219","PYSEC-2026-3838"],"summary":"GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-76220","upstream":["GHSA-wvpp-8hx9-p66j","CVE-2026-76220","PYSEC-2026-3843"],"summary":"GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-76221","upstream":["GHSA-jm78-9fvv-mhgr","CVE-2026-76221","PYSEC-2026-3783"],"summary":"GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-76222","upstream":["GHSA-hmq2-w58f-27jc","CVE-2026-76222","PYSEC-2026-3784"],"summary":"GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-78675","upstream":["GHSA-7833-fr7j-v32q","CVE-2026-78675","PYSEC-2026-3785"],"summary":"GitPython: Arbitrary local file content disclosure via [include] directive in untrusted .gitmodules (SubmoduleConfigParser never disables merge_includes)","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-78676","upstream":["GHSA-284h-m62q-gf8w","CVE-2026-78676","PYSEC-2026-3786"],"summary":"GitPython: Dormant multi-line git-config values are corrupted into live injected directives (e.g. core.hooksPath) on any unrelated GitConfigParser write, enabling RCE","severity":"critical"},{"id":"BREW-kimi-cli-CVE-2026-78677","upstream":["GHSA-8mcc-hrx5-hvxc","CVE-2026-78677","PYSEC-2026-3787"],"summary":"GitPython: clone_from()/clone() omit --separate-git-dir from unsafe_git_clone_options, enabling arbitrary git-directory creation outside the destination","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-78678","upstream":["GHSA-5xxx-qhh7-9287","CVE-2026-78678","PYSEC-2026-3788"],"summary":"GitPython: Incomplete unsafe_git_revision_options denylist omits --contents/-S, enabling arbitrary file read via Repo.blame()","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-78679","upstream":["GHSA-3wxw-xv34-2frg","CVE-2026-78679","PYSEC-2026-3837"],"summary":"GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)","severity":"medium"},{"id":"BREW-kimi-cli-CVE-2026-87817","upstream":["PYSEC-2026-3982","CVE-2026-87817","GHSA-239g-whfq-7xj9"],"summary":"GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-87819","upstream":["PYSEC-2026-3984","CVE-2026-87819","GHSA-g5vv-9gxw-82hx"],"summary":"GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing","severity":"high"},{"id":"BREW-kimi-cli-CVE-2026-97687","upstream":["GHSA-8988-9cw3-xx77","CVE-2026-97687","PYSEC-2026-4175"],"summary":"urllib3: HTTPS proxy TLS configuration may be ignored or overridden"},{"id":"BREW-kimi-cli-CVE-2026-97688","upstream":["GHSA-gh4c-6fx4-qh6g","CVE-2026-97688","PYSEC-2026-4176"],"summary":"urllib3: Chunked Deflate streaming can enter an infinite loop"},{"id":"BREW-kimi-cli-CVE-2026-97689","upstream":["GHSA-vxq7-64xx-v4gw","CVE-2026-97689","PYSEC-2026-4177"],"summary":"urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory"}],"patched":[],"fixed_count":84},"analytics":{"install":{"30d":{"kimi-cli":17},"90d":{"kimi-cli":433,"kimi-cli --HEAD":1},"365d":{"kimi-cli":8760,"kimi-cli --HEAD":7}},"install_on_request":{"30d":{"kimi-cli":17},"90d":{"kimi-cli":433,"kimi-cli --HEAD":1},"365d":{"kimi-cli":8758,"kimi-cli --HEAD":7}},"build_error":{"30d":{"kimi-cli":0}}},
"generated_date":"2026-10-08"}