Threats affecting pkg:npm/kiro-cli

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	7.8	EPSS 0.2%	CVE-2026-18656CVE-2026-18656 & CVE-2026-18657 - Issue with Kiro IDE and CLI - Executable Resolution from Untrusted Project Directory on Windows High7.8EPSS 0.2%2026-08-04AWS Security BulletinsCVE-2026-18656 Bulletin ID: 2026-074-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/04/2026 12:30 PM PDT Description: Kiro is an agentic IDE and command-line interface users install on their desktop. We identified CVE-2026-18656 and CVE-2026-18657, an issue where an uncontrolled search path element on Windows might allow an actor to execute arbitrary code via a maliciously crafted project directory containing a planted executable that is resolved before the system PATH when a local user opens the directory. Impacted versions: - Kiro IDE for Windows between versions 1.0.0 through 1.0.212 - Kiro CLI for Windows prior to v2.10.0 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin. EPSS 0.2%Report on CVE-2026-18656 Vulnerability CWE-427 #windows #cloud	AWS Security Bulletins	2026-08-04

Page 1 of 1