NVIDIA Kimi Vision

• Analyzed: May 12, 2026, 4:16 AM
• Findings: 1
• Version: 1.0.3
• Hash: c542b04f429fb5ab41708195924ff1716997ea5a7e3dd514e76eafc72c4feb98
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `scripts/analyze_image.py` file contains an information disclosure vulnerability. The `get_api_key` function, when provided with a third command-line argument, attempts to read that argument as a file path if it exists. This allows an attacker to specify a path to an arbitrary sensitive file (e.g., `~/.ssh/id_rsa`, `/etc/passwd`). The content of this file is then used as the API key and sent in the `Authorization` header to NVIDIA's API endpoint (`https://integrate.api.nvidia.com`). While the data is sent to a legitimate third party (NVIDIA), this constitutes an unauthorized information disclosure risk.