Uncontrolled Search Path Element in Kiro IDE Affects Windows Users
CVE-2026-18656

8.5HIGH

Key Information:

Vendor

Amazon

Status
Kiro Ide
Vendor
CVE Published:
4 August 2026

What is CVE-2026-18656?

Kiro IDE prior to version 1.0.228 contains a vulnerability that may permit remote unauthenticated users to execute arbitrary code. This threat arises from an uncontrolled search path element which, when exploited via a specially crafted project directory, can circumvent the workspace trust protections. Users should promptly upgrade to version 1.0.228 or later to enhance their security posture.

Affected Version(s)

Kiro IDE 1.0.0 <= 1.0.212

References

https://kiro.dev/changelog/ide/1-0/#patch-1-0-228
release-notespatch
https://aws.amazon.com/security/security-bulletins/2026-0...
vendor-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.