CVE-2026-18656 Executable Resolution from Untrusted Project Directory in Kiro IDE on Windows

HighCVSS 8.5 EPSS 0.22%

Published: 2026-08-04 22:35
Updated: 2026-10-24 19:10
Exploit status: No public exploit known

Description

An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user opens the directory.

To remediate this issue, users should upgrade to version 1.0.228 or higher.

Affected products

Product	Affected versions	Fixed in
Amazon Kiro IDE	>= 1.0.0, <= 1.0.212	No fix listed
Amazon Kiro IDE	< 1.0.228	1.0.228

References

kiro.dev patch release-notes
aws.amazon.com vendor-advisory

CVSS v4.0

8.5 High

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Local
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: Passive
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (4)

v4.0 8.5 · amzn
v4.0 8.5 · ff89ba41-3aa1-4d27-914a-91399e9639e5
v3.1 7.8 · amzn
v3.1 7.8 · ff89ba41-3aa1-4d27-914a-91399e9639e5

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.22% (percentile 13.1)
CWE: CWE-427 Uncontrolled Search Path Element

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.