What’s Vulnerable › Vulnerabilities

CVE-2026-18656: Executable Resolution from Untrusted Project Directory in Kiro IDE on Windows

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-04 · updated 2026-10-24
• Weakness: CWE-427

Description

An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user opens the directory. To remediate this issue, users should upgrade to version 1.0.228 or higher.

Affected products

• AWS Kiro IDE: before 1.0.228 — fixed in 1.0.228

How to fix

Upgrade to a fixed version: AWS Kiro IDE 1.0.228. Check the vendor advisory for mitigations.

References

• https://aws.amazon.com/security/security-bulletins/2026-074-aws/
• https://kiro.dev/changelog/ide/1-0/#patch-1-0-228

Get alerted when CVE-2026-18656 or the next vulnerability affects your stack