High severity · published Jun 2, 2026
CVE-2026-10591
Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths
8.8
CVSS
0.8%
EPSS
No
On KEV
Description
Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths (such as .vscode/tasks.json), enabling auto-execution on folder open.
To remediate this issue, users should upgrade to Kiro IDE version 0.11 or later.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
Kiro IDE · AWS
before 0.11 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-10591
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-10591
Vendor Advisory
https://aws.amazon.com/security/security-bulletins/2026-037-aws/
Release Notes
https://kiro.dev/changelog/ide/0-11/
More from Kiro IDE
7.8
CVE-2026-5429
Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme
7.8
CVE-2026-4295
Arbitrary code execution via crafted project files in Kiro IDE
5.5
CVE-2026-89332
Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration
5.5
CVE-2026-11931
Insecure Permissions on Authentication Token Cache File in Kiro IDE