CVE-2026-10591
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths (such as .vscode/tasks.json), enabling auto-execution on folder open.
Risk Assessment
The risk is that an attacker can remotely execute arbitrary commands on the victim's system, potentially leading to full system compromise or data theft.
Recommendation
It is recommended to immediately upgrade Amazon Kiro IDE to version 0.11 or later, which fixes this vulnerability.
Other vulnerabilities in Amazon Kiro IDE
See all- CVE-2026-95985High
The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths. Upgrading to Kiro IDE version 1.0.242 or later is recommended.
- CVE-2026-89332Medium
The Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 allows inclusion of functionality from an untrusted control sphere. Crafted repository content can modify the workspace settings file, redirecting the Kiro Powers registry request to an attacker-controlled endpoint and sending workspace data when the Powers panel is opened.
Original NVD description (English source)
Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths (such as .vscode/tasks.json), enabling auto-execution on folder open. To remediate this issue, users should upgrade to Kiro IDE version 0.11 or later.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS