Approved changes feed: RSS · Atom
cpe:2.3:a:aws:kiro_ide:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Aws (e6707f00-6abb-51df-808c-9e3417305027) |
|---|---|
| Product | Kiro Ide (cc80c087-f809-5b03-a206-e5e2e4290f7a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-11931 |
vulnerable | 2026-07-29 00:23:31.794528 |
Insecure Permissions on Authentication Token Cache File in Kiro IDE
MEDIUM (5.5)
Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication token cache file to other local users or processes via world-readable permissions (0644) instead of owner-restricted permissions (0600).
To remediate this issue, users should upgrade to Kiro IDE version 0.11.133 or later. After upgrading and restarting the application, the cache file permissions are automatically updated on the next token refresh. Users operating in a multi-user environment can invalidate existing tokens by reauthenticating.
Published: 2026-06-15T18:33:27.898Z
Updated: 2026-06-15T20:08:12.566Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-5429 |
vulnerable | 2026-06-08 08:07:03.698402 |
Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme
HIGH (7.8)
Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a remote unauthenticated threat actor to execute arbitrary code via a potentially damaging crafted color theme name when a local user opens the workspace. This issue requires the user to trust the workspace when prompted.
To remediate this issue, users should upgrade to version 0.8.140.
Published: 2026-04-02T18:37:42.972Z
Updated: 2026-04-02T19:22:46.775Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4295 |
vulnerable | 2026-06-08 08:05:13.148134 |
Arbitrary code execution via crafted project files in Kiro IDE
HIGH (7.8)
Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote unauthenticated threat actor to execute arbitrary code via maliciously crafted project directory files that bypass workspace trust protections when a local user opens the directory.
To remediate this issue, users should upgrade to version 0.8.0 or higher.
Published: 2026-03-17T19:11:58.702Z
Updated: 2026-03-18T14:07:58.063Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-10591 |
vulnerable | 2026-06-08 07:47:13.828997 |
Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths
HIGH (8.8)
Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths (such as .vscode/tasks.json), enabling auto-execution on folder open.
To remediate this issue, users should upgrade to Kiro IDE version 0.11 or later.
Published: 2026-06-02T15:34:40.106Z
Updated: 2026-06-03T03:56:03.860Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-0830 |
vulnerable | 2026-06-08 07:47:13.263072 |
Command Injection in Kiro GitLab Merge Request Helper
HIGH (7.8)
Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when opening maliciously crafted workspaces.
To mitigate, users should update to the latest version.
Published: 2026-01-09T21:10:09.310Z
Updated: 2026-01-09T21:18:53.768Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.