CVE-2026-10591

CVE-2026-10591 affects Amazon Kiro IDE prior to 0.11. The issue is insufficient access control in the file write tool, allowing remote unauthenticated actors to cause writes to execution-sensitive paths (e.g., .vscode/tasks.json), enabling automatic execution on folder open. Impact is high: poten...

CVE-2026-18656

Kiro IDE on Windows prior to 1.0.228 is affected by an uncontrolled search path element vulnerability that can let a remote unauthenticated actor execute arbitrary code via a malicious project directory containing an executable, bypassing workspace trust protections when a local user opens the di...

CVE-2026-0830

CVE-2026-0830 affects Kiro IDE (pre-0.6.18). The vulnerability arises from processing specially crafted workspace folder names in the GitLab Merge Request helper, which can lead to arbitrary command injection on the user’s machine when opening malicious workspaces. Public sources (NVD, Red Hat, C...