Vulnerability in Kiro IDE Affects Code Execution Capabilities
CVE-2026-4295

8.5HIGH

Key Information:

Vendor

Aws

Status
Kiro Ide
Vendor
CVE Published:
17 March 2026

What is CVE-2026-4295?

A security flaw in Kiro IDE prior to version 0.8.0 allows an unauthenticated attacker to exploit improper trust boundary enforcement. This vulnerability enables the execution of arbitrary code by using specially crafted project directory files. When a local user opens one of these directories, the workspace trust protections can be bypassed, leading to potential unauthorized actions within the IDE. It is recommended to upgrade to version 0.8.0 or later to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Kiro IDE 0.1.0 < 0.8.0

References

https://aws.amazon.com/security/security-bulletins/2026-0...
vendor-advisory
https://kiro.dev/changelog/ide/0-8/
release-notes

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.