VYPR
← All advisories
High severity8.8NVD Advisory· Published Jun 2, 2026· Updated Jun 5, 2026

CVE-2026-10591

CVE-2026-10591

Description

Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths (such as .vscode/tasks.json), enabling auto-execution on folder open.

To remediate this issue, users should upgrade to Kiro IDE version 0.11 or later.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Amazon/Kiro Ide2 versions
    cpe:2.3:a:amazon:kiro_ide:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:amazon:kiro_ide:*:*:*:*:*:*:*:*range: <0.11
    • (no CPE)range: <0.11

Patches

Vulnerability mechanics

References

2

News mentions

1