Kiro IDE vulnerabilities
4 known vulnerabilities in Kiro IDE from AWS. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
Kiro IDE: Incorrect Permission Assignment for Critical Resource
Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths (such as .vsc
- 7.8 High severity
Kiro IDE: Improper Neutralization of Input During Web Page Generation
Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a remote unauthenticated threat actor to execute arbitrary code via a potentially damaging crafted color theme name when a local user opens the wor
- 7.8 High severity
Kiro IDE: Inclusion of Functionality from Untrusted Control Sphere
Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote unauthenticated threat actor to execute arbitrary code via maliciously crafted project directory files that bypass workspace trust protections
- 7.8 High severity
Kiro IDE: Improper Neutralization of Special Elements used in an OS Command
Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when opening maliciously crafted workspaces. To mitigate, users should update to the lates