Vulnerability · Published Mar 17, 2026 · Assigned by AMZN
CVE-2026-4295Arbitrary code execution via crafted project files in Kiro IDE
High 7.8
In plain English
A high-severity security flaw in Kiro IDE from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 87.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote unauthenticated threat actor to execute arbitrary code via maliciously crafted project directory files that bypass workspace trust protections when a local user opens the directory. To remediate this issue, users should upgrade to version 0.8.0 or higher.
Affected products (as reported)
Weakness: CWE-829 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://aws.amazon.com/security/security-bulletins/2026-009-AWS/ vendor-advisory
- https://kiro.dev/changelog/ide/0-8/ release-notes