CVE-2026-4295 Arbitrary code execution via crafted project files in Kiro IDE

Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote unauthenticated threat actor to execute arbitrary code via maliciously crafted project directory files that bypass workspace trust protections when a local user opens the directory...

PT-2026-25936

Name of the Vulnerable Software and Affected Versions Kiro IDE versions prior to 0.8.0 Description A flaw exists in Kiro IDE that involves improper enforcement of trust boundaries. This could allow a remote, unauthenticated attacker to execute arbitrary code by using specially crafted project...

CVE-2026-4295: Inclusion of Functionality from Untrusted Control Sphere

Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote unauthenticated threat actor to execute arbitrary code via maliciously crafted project directory files that bypass workspace trust protections when a local user opens the directory...