Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces
The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths. We recommend you upgrade to Kiro IDE version 1.0.242 or later. Users who ran the agent in an untrusted workspace on an earlier version should also review the global Kiro configuration directory (~/.kiro) for entries they did not create.
CVE-2026-95985
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-95985
Kiro IDE
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Amazon",
"product": "Kiro IDE",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.0.242",
"versionType": "custom"
}
],
"platforms": [
"MacOS",
"Windows",
"Linux"
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-95985
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #1820 · Revision 1
- Added to Heist Feed
- Publisher date