What is the CVSS score of CVE-2026-4295?

CVE-2026-4295 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of AWS are affected by CVE-2026-4295?

Kiro IDE versions prior to 0.8.0 contain a trust boundary enforcement flaw that allows remote attackers to execute arbitrary code when users open malicious project directories, directly circumventing…. A patch is available.

Is there a public PoC exploit available for CVE-2026-4295?

Yes, a public proof-of-concept exploit is available for CVE-2026-4295. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4295?

Within 24 hours: Inventory all Kiro IDE installations across development teams and identify current versions. Within 7 days: Upgrade all instances to Kiro IDE 0.8.0 or later; validate upgrade completion across all developers and CI/CD pipelines. Within 30 days: Conduct code review of any projects opened in Kiro IDE from untrusted sources since last verified clean version; scan development systems for indicators of compromise.

AWS CVE-2026-4295

EUVD-2026-12638 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-03-17 AMZN

RCE AWS Kiro Ide

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:21 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

0.8.0

EUVD ID Assigned

Mar 17, 2026 - 20:30 euvd

EUVD-2026-12638

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

CVE Published

Mar 17, 2026 - 19:11 nvd

HIGH 7.8

DescriptionCVE.org

Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote unauthenticated threat actor to execute arbitrary code via maliciously crafted project directory files that bypass workspace trust protections when a local user opens the directory.

To remediate this issue, users should upgrade to version 0.8.0 or higher.

AnalysisAI

A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local user opens a maliciously crafted project directory. The vulnerability affects all versions of Kiro IDE prior to 0.8.0 on all supported platforms and bypasses workspace trust protections designed to prevent unauthorized code execution. While not currently listed in CISA KEV or showing high EPSS scores, the vulnerability enables remote code execution through local user interaction.

Technical ContextAI

Kiro IDE is an integrated development environment published by AWS, as indicated by the CPE identifier cpe:2.3:a:aws:kiro_ide. The vulnerability stems from CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), where the application fails to properly validate and enforce trust boundaries when processing project directory files. This allows untrusted code or configuration files within a project directory to bypass the workspace trust mechanism that should prevent automatic execution of potentially dangerous operations when opening unfamiliar projects.

RemediationAI

Users should immediately upgrade Kiro IDE to version 0.8.0 or higher as specified in the vendor advisory at https://aws.amazon.com/security/security-bulletins/2026-009-AWS/. Until patching is complete, users should avoid opening project directories from untrusted sources and verify the integrity of project files before opening them in the IDE. Organizations should review the Kiro IDE 0.8.0 changelog at https://kiro.dev/changelog/ide/0-8/ for complete remediation details and any additional security improvements included in the update.