Which versions of Amazon Kiro IDE are affected by CVE-2026-10591?

Amazon Kiro IDE versions prior to 0.11 contain a critical vulnerability allowing remote attackers to execute arbitrary code on developer workstations by planting malicious task configuration files…. A patch is available.

How to fix or mitigate CVE-2026-10591?

24 hours: Identify all developers using Amazon Kiro IDE versions prior to 0.11; restrict their access to external code repositories pending remediation and enable monitoring of their development machines for suspicious process execution. 7 days: Upgrade all affected Kiro IDE installations to version 0.11 or later across the organization. 30 days: Audit all source code repositories and build artifacts produced on affected machines during the exposure period for unauthorized modifications or injected code.

Amazon Kiro IDE CVE-2026-10591

Q: What is the CVSS score of CVE-2026-10591?

CVE-2026-10591 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-33964 HIGH

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-06-02 AMZN

GHSA-83m8-c7v3-rw3w

RCE AWS Kiro Ide

8.6

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (AMZN) · only source for this CVE.

CVSS VectorVendor: AMZN

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 02, 2026 - 17:01 EUVD

Analysis Updated

Jun 02, 2026 - 16:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 02, 2026 - 16:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 02, 2026 - 16:22 vuln.today

cvss_changed

CVSS changed

Jun 02, 2026 - 16:22 NVD

8.8 (HIGH) 8.6 (HIGH)

Analysis Generated

Jun 02, 2026 - 16:00 vuln.today

DescriptionCVE.org

Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths (such as .vscode/tasks.json), enabling auto-execution on folder open.

To remediate this issue, users should upgrade to Kiro IDE version 0.11 or later.

AnalysisAI

Arbitrary command execution in Amazon Kiro IDE versions prior to 0.11 allows remote attackers to plant malicious task definitions (e.g., .vscode/tasks.json) via the IDE's file write tool, which then auto-execute when a developer opens the affected workspace folder. The CVSS 4.0 score of 8.6 reflects network-reachable abuse with high confidentiality, integrity, and availability impact contingent on a single user action (folder open). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Kiro IDE is AWS's AI-assisted development environment (cpe:2.3:a:aws:kiro_ide:*) that exposes an agent-driven file write tool. The flaw is a CWE-732 (Incorrect Permission Assignment for Critical Resource) issue: the write tool fails to restrict which paths the agent may modify, treating execution-sensitive locations like the VS Code workspace task manifest (.vscode/tasks.json) the same as ordinary source files. Because VS Code-derived IDEs honor 'runOn: folderOpen' task entries, any attacker-controlled content written there is executed by the host shell as soon as the workspace is reopened, converting a file-write primitive into code execution.

RemediationAI

Vendor-released patch: Amazon Kiro IDE 0.11 - upgrade all developer workstations to 0.11 or later per the AWS security bulletin (https://aws.amazon.com/security/security-bulletins/2026-037-aws/) and the changelog (https://kiro.dev/changelog/ide/0-11/). Until the upgrade is rolled out, avoid opening untrusted repositories or AI-generated workspaces in Kiro, and treat any folder the agent has written into as untrusted; inspect .vscode/tasks.json (and equivalent auto-run manifests like .vscode/launch.json or settings.json scripts) before reopening a workspace, since malicious entries execute on folder open. As a structural control, open suspect projects in VS Code's Restricted Mode equivalent or inside a disposable dev container/VM so any auto-run tasks fire in an isolated context - the trade-off is loss of full IDE/agent capabilities and added friction for legitimate workspace setup tasks.