7.8
High
CVE-2026-4295 Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote…
Description
Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote unauthenticated threat actor to execute arbitrary code via maliciously crafted project directory files that bypass workspace trust protections when a local user opens the directory. To remediate this issue, users should upgrade to version 0.8.0 or higher.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Kiro IDE 0.1 | 0.1.0 → < 0.8.0 | 0.8.0 |
Other CVEs of Kiro IDE
The 6 CVEs of Kiro IDE →
CVE-2026-89332
Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version…
5.5
Medium
CVE-2026-11931
Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication…
6.8
Medium
CVE-2026-10591
Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow…
8.8
High
CVE-2026-5429
Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a…
7.8
High