8.4
High
CVE-2026-0830 Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab…
Description
Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when opening maliciously crafted workspaces. To mitigate, users should update to the latest version.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Kiro IDE 0.6 | earliest → < 0.6.18 | 0.6.18 |
Other CVEs of Kiro IDE
The 6 CVEs of Kiro IDE →
CVE-2026-89332
Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version…
5.5
Medium
CVE-2026-11931
Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication…
6.8
Medium
CVE-2026-10591
Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow…
8.8
High
CVE-2026-5429
Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a…
7.8
High