Kiro Ide
Monthly
Remote code execution via uncontrolled search path (CWE-427) in Amazon Kiro IDE before 1.0.228 on Windows allows an unauthenticated remote actor to execute arbitrary code on a victim's machine by supplying a maliciously crafted project directory containing a strategically placed executable. Exploitation requires the local user to open the attacker-controlled directory, at which point Kiro IDE resolves an uncontrolled search path and executes the malicious binary, bypassing workspace trust protections intended to prevent exactly this class of attack. No public exploit has been identified at time of analysis, and a vendor-released patch is available at version 1.0.228.
Arbitrary command execution in Amazon Kiro IDE versions prior to 0.11 allows remote attackers to plant malicious task definitions (e.g., .vscode/tasks.json) via the IDE's file write tool, which then auto-execute when a developer opens the affected workspace folder. The CVSS 4.0 score of 8.6 reflects network-reachable abuse with high confidentiality, integrity, and availability impact contingent on a single user action (folder open). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary code execution in AWS Kiro IDE versions prior to 0.8.140 occurs when a local user opens a maliciously crafted workspace containing an unsanitized color theme name, exploiting improper neutralization of input during webview generation. The attack requires user interaction (trusting the workspace when prompted) and can deliver full system compromise with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though SSVC framework rates technical impact as total with manual (non-automatable) exploitation potential.
A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local user opens a maliciously crafted project directory. The vulnerability affects all versions of Kiro IDE prior to 0.8.0 on all supported platforms and bypasses workspace trust protections designed to prevent unauthorized code execution. While not currently listed in CISA KEV or showing high EPSS scores, the vulnerability enables remote code execution through local user interaction.
Kiro IDE versions before 0.6.18 are vulnerable to command injection when processing maliciously named workspace folders in the GitLab Merge-Request helper, allowing local attackers with user interaction to execute arbitrary commands with high impact on confidentiality, integrity, and availability. The vulnerability requires local access and user interaction to open a crafted workspace, but no patch is currently available and exploitation requires minimal complexity. Users should restrict workspace access and avoid opening untrusted workspace folders until an update is released.
Workspace data exfiltration in Amazon Kiro IDE before version 0.8.135 allows remote unauthenticated attackers to steal developer credentials and sensitive project data through crafted repository content. When a developer opens a malicious project, the Kiro AI agent is manipulated - via CWE-829 inclusion from an untrusted control sphere - into overwriting the workspace settings file, redirecting the Kiro Powers registry to an attacker-controlled endpoint. Once the developer subsequently opens the Powers panel, workspace data, including any credentials present in the project, is transmitted to the attacker's server. Vendor-released patch 0.8.135 is available; no public exploit has been identified at time of analysis.
Authentication token cache file exposure in Kiro IDE on macOS and Linux allows any local user to read credentials belonging to other users due to world-readable file permissions (0644) instead of the security-appropriate owner-only permissions (0600). All versions before 0.11.133 are affected on UNIX-based platforms; the vulnerability is confirmed by AWS via security bulletin 2026-045 and has been assigned CWE-276 (Incorrect Default Permissions). No public exploit code has been identified at time of analysis, but exploitation requires no technical sophistication - only filesystem read access on a shared system.
Remote code execution via uncontrolled search path (CWE-427) in Amazon Kiro IDE before 1.0.228 on Windows allows an unauthenticated remote actor to execute arbitrary code on a victim's machine by supplying a maliciously crafted project directory containing a strategically placed executable. Exploitation requires the local user to open the attacker-controlled directory, at which point Kiro IDE resolves an uncontrolled search path and executes the malicious binary, bypassing workspace trust protections intended to prevent exactly this class of attack. No public exploit has been identified at time of analysis, and a vendor-released patch is available at version 1.0.228.
Arbitrary command execution in Amazon Kiro IDE versions prior to 0.11 allows remote attackers to plant malicious task definitions (e.g., .vscode/tasks.json) via the IDE's file write tool, which then auto-execute when a developer opens the affected workspace folder. The CVSS 4.0 score of 8.6 reflects network-reachable abuse with high confidentiality, integrity, and availability impact contingent on a single user action (folder open). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary code execution in AWS Kiro IDE versions prior to 0.8.140 occurs when a local user opens a maliciously crafted workspace containing an unsanitized color theme name, exploiting improper neutralization of input during webview generation. The attack requires user interaction (trusting the workspace when prompted) and can deliver full system compromise with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, though SSVC framework rates technical impact as total with manual (non-automatable) exploitation potential.
A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local user opens a maliciously crafted project directory. The vulnerability affects all versions of Kiro IDE prior to 0.8.0 on all supported platforms and bypasses workspace trust protections designed to prevent unauthorized code execution. While not currently listed in CISA KEV or showing high EPSS scores, the vulnerability enables remote code execution through local user interaction.
Kiro IDE versions before 0.6.18 are vulnerable to command injection when processing maliciously named workspace folders in the GitLab Merge-Request helper, allowing local attackers with user interaction to execute arbitrary commands with high impact on confidentiality, integrity, and availability. The vulnerability requires local access and user interaction to open a crafted workspace, but no patch is currently available and exploitation requires minimal complexity. Users should restrict workspace access and avoid opening untrusted workspace folders until an update is released.
Workspace data exfiltration in Amazon Kiro IDE before version 0.8.135 allows remote unauthenticated attackers to steal developer credentials and sensitive project data through crafted repository content. When a developer opens a malicious project, the Kiro AI agent is manipulated - via CWE-829 inclusion from an untrusted control sphere - into overwriting the workspace settings file, redirecting the Kiro Powers registry to an attacker-controlled endpoint. Once the developer subsequently opens the Powers panel, workspace data, including any credentials present in the project, is transmitted to the attacker's server. Vendor-released patch 0.8.135 is available; no public exploit has been identified at time of analysis.
Authentication token cache file exposure in Kiro IDE on macOS and Linux allows any local user to read credentials belonging to other users due to world-readable file permissions (0644) instead of the security-appropriate owner-only permissions (0600). All versions before 0.11.133 are affected on UNIX-based platforms; the vulnerability is confirmed by AWS via security bulletin 2026-045 and has been assigned CWE-276 (Incorrect Default Permissions). No public exploit code has been identified at time of analysis, but exploitation requires no technical sophistication - only filesystem read access on a shared system.