Amazon
Amazon Kiro IDE: vulnerabilidades y CVE
Amazon Kiro IDE tiene 7 vulnerabilidades publicadas, 7 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE7
Últimos 12 meses7
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-95985 | Alta (8.6) | 0.14% | — | 24 sept 2026 | The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an… |
| CVE-2026-89332 | Media (6.7) | 0.18% | — | 11 sept 2026 | Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer… |
| CVE-2026-18656 | Alta (8.5) | 0.22% | — | 4 ago 2026 | An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable… |
| CVE-2026-10591 | Alta (8.6) | 0.69% | — | 2 jun 2026 | Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes… |
| CVE-2026-5429 | Alta (7.1) | 0.23% | — | 2 abr 2026 | Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a remote unauthenticated threat actor to execute arbitrary code via a potentially damaging crafted color… |
| CVE-2026-4295 | Alta (8.5) | 0.20% | — | 17 mar 2026 | Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote unauthenticated threat actor to execute arbitrary code via maliciously crafted project directory files… |
| CVE-2026-0830 | Alta (8.4) | 1.5% | — | 9 ene 2026 | Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when opening maliciously crafted workspaces. To… |