CVE-2026-4295

Summary

Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote unauthenticated threat actor to execute arbitrary code via maliciously crafted project directory files that bypass workspace trust protections when a local user opens the directory.

To remediate this issue, users should upgrade to version 0.8.0 or higher.

Affected Software

VendorProductVersion RangeStatus
AWSKiro IDE0.1.0 < 0.8.0affected

Weaknesses

  • CWE-829: CWE-829 Inclusion of functionality from untrusted control sphere

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References