Unrated severityNVD Advisory· Published Mar 17, 2026· Updated Mar 18, 2026
Arbitrary code execution via crafted project files in Kiro IDE
CVE-2026-4295
Description
Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote unauthenticated threat actor to execute arbitrary code via maliciously crafted project directory files that bypass workspace trust protections when a local user opens the directory.
To remediate this issue, users should upgrade to version 0.8.0 or higher.
Affected products
2- AWS/Kiro IDEv5Range: 0.1.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- aws.amazon.com/security/security-bulletins/2026-009-AWS/mitrevendor-advisory
- kiro.dev/changelog/ide/0-8/mitrerelease-notes
News mentions
0No linked articles in our index yet.