CVE-2026-18656 & CVE-2026-18657 - Issue with Kiro IDE and CLI - Executable Resolution from Untrusted Project Directory on Windows
CVE-2026-18656 and CVE-2026-18657 are vulnerabilities in Kiro IDE and CLI for Windows that allow arbitrary code execution via an uncontrolled search path element. A maliciously crafted project directory containing a planted executable can be resolved before the system PATH when a local user opens the directory. This affects Kiro IDE versions 1.0.0 through 1.0.212 and Kiro CLI versions prior to 2.10.0. The issue has been fixed in Kiro IDE 1.0.228 and Kiro CLI 2.10.0. No workaround is available, so upgrading is required.
AI Analysis
Technical Summary
Kiro IDE and CLI for Windows suffer from an executable resolution vulnerability where an attacker can place a malicious executable in a project directory that is resolved before the system PATH. This allows arbitrary code execution when a local user opens the directory. The affected versions are Kiro IDE 1.0.0 through 1.0.212 and Kiro CLI prior to 2.10.0. The vendor has released fixed versions 1.0.228 for the IDE and 2.10.0 for the CLI to address this issue. No workaround exists, making patching the only remediation.
Potential Impact
An attacker with the ability to place files in a project directory on a Windows system running vulnerable versions of Kiro IDE or CLI can execute arbitrary code with the privileges of the local user. This can lead to compromise of the user's environment and potentially further system access depending on user privileges.
Mitigation Recommendations
Upgrade Kiro IDE to version 1.0.228 or later and Kiro CLI to version 2.10.0 or later. There are no available workarounds, so applying the official patches is necessary to remediate the vulnerability. Ensure any forked or derivative code is also patched accordingly.
CVE-2026-18656 & CVE-2026-18657 - Issue with Kiro IDE and CLI - Executable Resolution from Untrusted Project Directory on Windows
Description
CVE-2026-18656 and CVE-2026-18657 are vulnerabilities in Kiro IDE and CLI for Windows that allow arbitrary code execution via an uncontrolled search path element. A maliciously crafted project directory containing a planted executable can be resolved before the system PATH when a local user opens the directory. This affects Kiro IDE versions 1.0.0 through 1.0.212 and Kiro CLI versions prior to 2.10.0. The issue has been fixed in Kiro IDE 1.0.228 and Kiro CLI 2.10.0. No workaround is available, so upgrading is required.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Kiro IDE and CLI for Windows suffer from an executable resolution vulnerability where an attacker can place a malicious executable in a project directory that is resolved before the system PATH. This allows arbitrary code execution when a local user opens the directory. The affected versions are Kiro IDE 1.0.0 through 1.0.212 and Kiro CLI prior to 2.10.0. The vendor has released fixed versions 1.0.228 for the IDE and 2.10.0 for the CLI to address this issue. No workaround exists, making patching the only remediation.
Potential Impact
An attacker with the ability to place files in a project directory on a Windows system running vulnerable versions of Kiro IDE or CLI can execute arbitrary code with the privileges of the local user. This can lead to compromise of the user's environment and potentially further system access depending on user privileges.
Mitigation Recommendations
Upgrade Kiro IDE to version 1.0.228 or later and Kiro CLI to version 2.10.0 or later. There are no available workarounds, so applying the official patches is necessary to remediate the vulnerability. Ensure any forked or derivative code is also patched accordingly.
Technical Details
- Classification
- {"confidence":0.88,"severitySource":"default","classifier":"rss-v2"}
- Article Source
- {"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-074-aws/","fetched":true,"fetchedAt":"2026-08-04T19:45:17.890Z","wordCount":220}
Threat ID: 6a72414dbf8831d53957007c
Added to database: 08/04/2026, 19:45:17 UTC
Last enriched: 08/04/2026, 19:45:29 UTC
Last updated: 08/04/2026, 20:37:23 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.