🟠 High | Source: AWS Security Bulletins
Two vulnerabilities (CVE-2026-18656 and CVE-2026-18657) in AWS’s Kiro IDE and CLI for Windows allow an attacker to execute arbitrary code by planting a malicious executable inside a project directory. When a victim opens the compromised directory, Windows resolves the planted file before checking the system PATH, triggering execution without the user’s awareness. This is a classic uncontrolled search path (binary planting) attack requiring local or social-engineering access to deliver a malicious project folder.
Security Architect’s Take: Ensure all Windows-based developers using Kiro IDE upgrade to version 1.0.213 or later, and update the Kiro CLI to v2.10.0 or above immediately. As a compensating control, reinforce guidance to developers never to open project directories from untrusted or unverified sources, and consider enforcing application allowlisting policies (e.g. via AppLocker or Windows Defender Application Control) on developer endpoints to block untrusted executables.
Original advisory: CVE-2026-18656 & CVE-2026-18657 - Issue with Kiro IDE and CLI - Executable Resolution from Untrusted Project Directory on Windows