CVE-2026-4295 — Arbitrary code execution via crafted project files in Kiro IDE

CVE-2026-4295

Arbitrary code execution via crafted project files in Kiro IDE PUBLISHED

Description (CNA)

Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote unauthenticated threat actor to execute arbitrary code via maliciously crafted project directory files that bypass workspace trust protections when a local user opens the directory. To remediate this issue, users should upgrade to version 0.8.0 or higher.

Affected (CNA)

Vendor / product	Versions
AWS / Kiro IDE	affected 0.1.0 before 0.8.0

CWE

CWE-829

References

https://aws.amazon.com/security/security-bulletins/2026-009-AWS/
https://kiro.dev/changelog/ide/0-8/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.