Key points
- CVE-2026-18656 and CVE-2026-18657 affect Kiro IDE versions 1.0.0 through 1.0.212 on Windows.
- Attackers can execute arbitrary code by planting executables in untrusted project directories.
- Patches are available in Kiro IDE version 1.0.228 and Kiro CLI version 2.10.0.
AWS released security bulletin 2026-074-AWS on August 4, 2026, disclosing two vulnerabilities in its Kiro development tools. The advisory addresses CVE-2026-18656 and CVE-2026-18657, which impact the Kiro IDE and Command Line Interface. These flaws allow for arbitrary code execution on Windows systems when users interact with specific directory structures.
The core issue involves an uncontrolled search path element. When a local user opens a maliciously crafted project directory in Kiro, the application may resolve a planted executable before checking the system PATH. This behavior enables an actor to run unauthorized code simply by having the victim open the compromised directory.
Vulnerability Mechanics
AWS classifies this bulletin as important and requiring attention. The vulnerability exists because the software prioritizes executables found within the project directory over those in the standard system path. This resolution order creates a window for attackers to inject malicious binaries that execute with the privileges of the user opening the folder.
Affected Environments
The advisory specifies that the issue affects Kiro IDE for Windows between versions 1.0.0 through 1.0.212. The Kiro CLI is also impacted, though the advisory notes that the fix is available in version 2.10.0. The source material does not mention other operating systems.
Next steps
AWS has released patches for both affected components. Administrators should upgrade Kiro IDE to version 1.0.228 or later. For the command-line interface, version 2.10.0 includes the necessary fixes. Teams using forked or derivative code must ensure their builds incorporate these changes to maintain security.
Signals worth monitoring
Security teams should watch for unexpected process launches originating from user-writable project directories. Check for new executable files appearing in repositories that developers have recently checked out. Monitor for commands running with elevated privileges from non-standard paths. Verify that all development tools are updated to the latest patched versions to prevent local exploitation.
What to do and how to stay safe: AWS
- Update all Windows installations of Kiro IDE to version 1.0.228 or higher immediately.
- Upgrade Kiro CLI to version 2.10.0 to close the executable resolution gap.
- Audit recent project downloads for unexpected executable files in root directories.
- Ensure any custom forks of the Kiro codebase are patched with the latest security fixes.
Step-by-step guide: Emergency Patching Checklist for Critical System Fixes
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Kiro IDE are vulnerable to CVE-2026-18656?
Kiro IDE for Windows versions 1.0.0 through 1.0.212 are affected by this vulnerability.
Is there a patch available for these security issues?
Yes, AWS has released fixes in Kiro IDE version 1.0.228 and Kiro CLI version 2.10.0.
Who discovered these vulnerabilities in the Kiro tools?
Edo Maland reported the IDE issue, while researchers from Compass Security reported the CLI issue.
