CVE-2026-0830highCWE-78

CVE-2026-0830: falha de alta gravidade em AWS Kiro IDE

Command Injection in Kiro GitLab Merge Request Helper

Publicada em

Seguir esta CVE+ Monitorar Kiro IDE

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.4epss 1.4%
Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when opening maliciously crafted workspaces. To mitigate, users should update to the latest version.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
AWS · Kiro IDE
CVEs relacionadas — AWS Kiro IDE

No mesmo produto, das mais perigosas para as menos.

CVE-2026-10591HIGHKiro IDE Insufficient File Write Restrictions to Execution-Sensitive PathsEPSS 0.8%CVE-2026-4295HIGHArbitrary code execution via crafted project files in Kiro IDEEPSS 0.2%CVE-2026-89332MEDIUMKiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace ConfigurationEPSS 0.2%CVE-2026-5429HIGHKiro IDE Webview Cross-Site Scripting via Workspace Color ThemeEPSS 0.2%CVE-2026-11931MEDIUMInsecure Permissions on Authentication Token Cache File in Kiro IDEEPSS 0.1%