Bulletin ID: 2026-001-AWS
Scope: AWS
Content Type: Important (requires attention)
Publication Date: 2026/01/09 13:15 PM PST

Description:

Kiro is an agentic IDE users install on their desktop. We identified CVE-2026-0830 where opening a maliciously crafted workspace may lead to arbitrary command injection in Kiro IDE before Kiro version 0.6.18. This may occur if the workspace has specially crafted folder names within the workspace containing injected commands.

Resolution: Kiro IDE <0.6.18

Please refer to the article below for the most up-to-date information related to this AWS Security Bulletin.