CVE-2026-18656

An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user opens the directory. To remediate this issue, users should upgrade to version 1.0.228 or higher.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://aws.amazon.com/security/security-bulletins/2026-074-aws/	Vendor Advisory
https://kiro.dev/changelog/ide/1-0/#patch-1-0-228	Release Notes

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:amazon:kiro_ide:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Un elemento de ruta de búsqueda no controlado en Kiro IDE anterior a la versión 1.0.228 en Windows podría permitir a un actor remoto no autenticado ejecutar código arbitrario a través de un directorio de proyecto creado con fines maliciosos que contiene un ejecutable que omite las protecciones de confianza del espacio de trabajo cuando un usuario local abre el directorio. Para remediar este problema, los usuarios deben actualizar a la versión 1.0.228 o superior.

Information

Published : 2026-08-04 20:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-18656

Mitre link : CVE-2026-18656

CVE.ORG link : CVE-2026-18656

JSON object : View

Products Affected

microsoft

windows

amazon

kiro_ide

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2026-18656", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18656", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T14:50:18.116869Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "affectedData": [{"vendor": "Amazon", "product": "Kiro IDE", "versions": [{"status": "affected", "version": "1.0.0", "versionType": "custom", "lessThanOrEqual": "1.0.212"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-04T20:16:50.410", "references": [{"url": "https://aws.amazon.com/security/security-bulletins/2026-074-aws/", "tags": ["Vendor Advisory"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}, {"url": "https://kiro.dev/changelog/ide/1-0/#patch-1-0-228", "tags": ["Release Notes"], "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ff89ba41-3aa1-4d27-914a-91399e9639e5", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user opens the directory.\n\n\n\nTo remediate this issue, users should upgrade to version 1.0.228 or higher."}, {"lang": "es", "value": "Un elemento de ruta de b\u00fasqueda no controlado en Kiro IDE anterior a la versi\u00f3n 1.0.228 en Windows podr\u00eda permitir a un actor remoto no autenticado ejecutar c\u00f3digo arbitrario a trav\u00e9s de un directorio de proyecto creado con fines maliciosos que contiene un ejecutable que omite las protecciones de confianza del espacio de trabajo cuando un usuario local abre el directorio.\n\nPara remediar este problema, los usuarios deben actualizar a la versi\u00f3n 1.0.228 o superior."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:amazon:kiro_ide:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B39D848-DFA5-4537-A3BD-45DC5352FEF9", "versionEndExcluding": "1.0.228"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ff89ba41-3aa1-4d27-914a-91399e9639e5"}