High severity · published Sep 24, 2026
CVE-2026-95985
Kiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces
8.8
CVSS
0.1%
EPSS
No
On KEV
Description
The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths.
We recommend you upgrade to Kiro IDE version 1.0.242 or later. Users who ran the agent in an untrusted workspace on an earlier version should also review the global Kiro configuration directory (~/.kiro) for entries they did not create.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
Kiro IDE · Amazon
before 1.0.242 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-95985
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-95985
aws.amazon.com
https://aws.amazon.com/security/security-bulletins/2026-117-aws/
kiro.dev
https://kiro.dev/changelog/ide/1-0-242/
More from Kiro IDE
8.8
CVE-2026-10591
Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths
7.8
CVE-2026-18656
Executable Resolution from Untrusted Project Directory in Kiro IDE on Windows
7.8
CVE-2026-0830
Command Injection in Kiro GitLab Merge Request Helper
5.5
CVE-2026-89332
Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration