Live › vulnerability › CVE-2026-95985
Go to dashboardKiro IDE, an agentic coding editor, has a file write tool that, when the agent runs in a crafted untrusted repository, can modify auto-loaded global configuration paths on the user's machine. An attacker who supplies such a repository can get arbitrary command execution and inject instructions into the agent's context.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 20:05 UTC, 0h before NVD. All times on this page are UTC.
Developers who run Kiro IDE before 1.0.242 and open or run the agent in repositories they do not trust can be exposed, since the agent's writes can reach global configuration. Teams that only use Kiro on trusted workspaces are at lower risk, but the advisory recommends upgrading regardless. Teams not using Kiro can skip it.
No product ranges from the sources yet.
1.0.242.~/.kiro on macOS and Linux, or %USERPROFILE%\.kiro on Windows, for entries the user did not create.1.0.242 or later.~/.kiro (or %USERPROFILE%\.kiro) for unknown entries and remove them.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-95985 - Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces
Bulletin ID: 2026-117-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/24/2026 10:00 AM PDT
Description:
Kiro is an agentic IDE that users install on their desktop. We identified CVE-2026-95985. The file write tool in Kiro IDE before version 1.0.242 might allow remote unauthenticated actors to execute arbitrary commands and to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths.
Impacted versions: < 1.0.242
Resolution:
This issue has been addressed in Kiro IDE version 1.0.242. We recommend upgrading to the latest version. Users who ran the agent in an untrusted workspace on an earlier version should also review the global Kiro configuration directory (~/.kiro on macOS and Linux, %USERPROFILE%.kiro on Windows) for entries they did not create.
Workarounds:
None.
References:
Acknowledgement:
We would like to thank Dinh Ngoc Dung for collaborating on this issue through the coordinated disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-95985")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.