Kiro IDE vulnerabilities
3 known CVE vulnerabilities in Kiro IDE, translated and rated.
- CVE-2026-18656High
An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user opens the directory.
- CVE-2026-11931Medium
Kiro IDE on macOS and Linux before version 0.11.133 has incorrect default permissions that could expose the authentication token cache file to other local users or processes. The file permissions are set to 0644 instead of 0600.
- CVE-2026-5429High
In Kiro IDE before version 0.8.140, unsanitized input during web page generation in the Kiro Agent webview allows a remote unauthenticated attacker to execute arbitrary code via a crafted color theme name. This requires the user to trust the workspace when prompted.