Kiro IDE vulnerabilities

2 known vulnerabilities in Kiro IDE from Amazon. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Kiro IDE: Acceptance of Extraneous Untrusted Data With Trusted Data

  CVE-2026-95985Sep 24, 2026Amazon

  The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message

• 7.8 High severity

  Kiro IDE: Uncontrolled Search Path Element

  CVE-2026-18656Aug 4, 2026Amazon

  An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protection