CVE-2026-18656
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user opens the directory.
Risk Assessment
The risk is that opening a malicious project could lead to arbitrary code execution on the user's machine, potentially resulting in system compromise or data theft.
Recommendation
It is recommended to immediately upgrade Kiro IDE to version 1.0.228 or higher to mitigate this vulnerability.
Other vulnerabilities in Kiro IDE
See all- CVE-2026-11931Medium
Kiro IDE on macOS and Linux before version 0.11.133 has incorrect default permissions that could expose the authentication token cache file to other local users or processes. The file permissions are set to 0644 instead of 0600.
- CVE-2026-5429High
In Kiro IDE before version 0.8.140, unsanitized input during web page generation in the Kiro Agent webview allows a remote unauthenticated attacker to execute arbitrary code via a crafted color theme name. This requires the user to trust the workspace when prompted.
Original NVD description (English source)
An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user opens the directory. To remediate this issue, users should upgrade to version 1.0.228 or higher.