Kiro IDE CVE-2026-18656

Exploitation is limited to Windows installations of Kiro IDE versions prior to 1.0.228. The victim must open a maliciously crafted project directory in the IDE - this is the required user interaction and the primary attack delivery mechanism. The attacker must control or influence the contents of a project directory that the victim will open, typically achieved via a poisoned repository, shared archive, or crafted project template. The critical limiting factor is the workspace trust bypass: the attack is specifically designed to circumvent Kiro IDE's built-in trust prompt, meaning users who would normally be warned are not. No authentication is required of the attacker. Exploitation is scoped to the victim's local user context on Windows; the vulnerability is not present on other operating systems based on available data.

The CVSS 4.0 base score of 8.5 reflects high impact across confidentiality, integrity, and availability with a local attack vector and required user interaction. The local attack vector (AV:L) and user interaction requirement (UI:P) are the primary risk reducers - an attacker cannot exploit this remotely without first convincing a developer to open a crafted directory, which requires social engineering. This makes it a realistic but not trivially exploitable vulnerability, commonly delivered via poisoned GitHub repositories, zip archives, or shared project templates targeting developer workstations. No KEV listing exists, and no public proof-of-concept exploit has been identified, which is consistent with a moderate real-world exploitation probability at time of analysis. The bypass of workspace trust protections is a significant aggravating factor: users relying on that safeguard as their primary defense will receive no warning. Developer workstations are high-value targets as they typically hold credentials, source code, and cloud access tokens, amplifying the downstream impact of a successful compromise beyond the initial machine.

An attacker publishes a malicious open-source project or shared development template to a code hosting platform, embedding a Windows executable named to match a binary Kiro IDE searches for during startup or project initialization. A developer clones or downloads the repository and opens it in Kiro IDE; the IDE resolves the uncontrolled search path to the attacker's executable rather than the legitimate system binary, executing it silently and bypassing workspace trust warnings. The attacker's payload runs under the developer's account context with access to credentials, tokens, and local files. No public proof-of-concept has been identified at time of analysis.