CVE-2026-95985
HighCVSS 8.8Summary
The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths. Upgrading to Kiro IDE version 1.0.242 or later is recommended.
Risk Assessment
An attacker can inject malicious instructions into the agent's context, potentially leading to unauthorized modifications of the global Kiro configuration. Users who ran the agent in an untrusted workspace should review the ~/.kiro directory for entries they did not create.
Recommendation
Upgrade Amazon Kiro IDE to version 1.0.242 or later. Additionally, review the global Kiro configuration directory ~/.kiro and remove any entries you did not create.
Other vulnerabilities in Amazon Kiro IDE
See all- CVE-2026-89332Medium
The Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 allows inclusion of functionality from an untrusted control sphere. Crafted repository content can modify the workspace settings file, redirecting the Kiro Powers registry request to an attacker-controlled endpoint and sending workspace data when the Powers panel is opened.
- CVE-2026-10591High
Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths (such as .vscode/tasks.json), enabling auto-execution on folder open.
Original NVD description (English source)
The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths. We recommend you upgrade to Kiro IDE version 1.0.242 or later. Users who ran the agent in an untrusted workspace on an earlier version should also review the global Kiro configuration directory (~/.kiro) for entries they did not create.