CVE-2026-10591highCWE-732

CVE-2026-10591: fallo de gravedad alta en AWS Kiro IDE

Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Kiro IDE

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.6epss 0.8%
Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths (such as .vscode/tasks.json), enabling auto-execution on folder open. To remediate this issue, users should upgrade to Kiro IDE version 0.11 or later.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
AWS · Kiro IDE
CVEs relacionadas — AWS Kiro IDE

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-0830HIGHCommand Injection in Kiro GitLab Merge Request HelperEPSS 1.4%CVE-2026-4295HIGHArbitrary code execution via crafted project files in Kiro IDEEPSS 0.2%CVE-2026-89332MEDIUMKiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace ConfigurationEPSS 0.2%CVE-2026-5429HIGHKiro IDE Webview Cross-Site Scripting via Workspace Color ThemeEPSS 0.2%CVE-2026-11931MEDIUMInsecure Permissions on Authentication Token Cache File in Kiro IDEEPSS 0.1%