CVE-2026-89332 Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration

Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the...

CVE-2026-89332 Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration

Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the...

CVE-2026-87983

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace ...

CVE-2026-87988

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval...

CVE-2026-87988

Mistral Vibe is affected by an arbitrary file access vulnerability (CVE-2026-87988). The root cause is missing path validation for commands classified as unconditionally allowed , which allows an attacker to bypass workspace restrictions and access files outside the active workspace without user ...

CVE-2026-87988

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval...

CVE-2026-87988

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval...

EUVD-2026-76123

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval...

CVE-2026-87983

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace ...

CVE-2026-87983

An arbitrary file read vulnerability in Mistral Vibe (introduced in version 2.6.0 ) allows an attacker to bypass workspace restrictions by using quoted absolute paths in allowlisted shell commands. The root cause is improper handling of quotation marks during path validation, enabling files outsi...

EUVD-2026-76118

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace ...

CVE-2026-87983

An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace ...

CVE-2026-86145

A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the pcre2dfamatch function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction...

CVE-2026-89332: Inclusion of Functionality from Untrusted Control Sphere

Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the...

CVE-2026-78546: Out-of-bounds Read

Out-of-bounds read vulnerability in Citirx Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.11 Current Release CR, before 2507.1 LTSR CU3, and before LTSR 2607...

PT-2026-89890

Mistral Vibe CVE-2026-87988, CVSS 10.0 arbitrary file access via missing path validation on commands that were treated as unconditionally allowed. Unauthenticated attacker can break out of the intended workspace and read files they shouldn’t. Another case where “the command is allowed” was confus...

PT-2026-90052

Kiro IDE - Agent-Written Config - Data Exfiltration Attack Path - 1. Open a specially crafted untrusted repository in Kiro IDE. 2. The AI agent modifies the workspace configuration to point the Powers registry at an attacker-controlled endpoint. 3. Kiro asks the user to approve the change, but th...

CVE-2026-87988: Incorrect Permission Assignment for Critical Resource

An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval...

CVE-2026-87984: Improper Limitation of a Pathname to a Restricted Directory

An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to wri...

CVE-2026-78547: Out-of-bounds Write

Out-of-bounds write vulnerability in Citrix Citrix Workspace app for Windows. This issue affects Citrix Workspace app for Windows: before 2603.11 Current Release CR, before 2507.1 LTSR CU3, and before LTSR 2607...