CVE-2026-10591CWE-732

CVE-2026-10591

High · published June 2, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
52.4
In the wild
Unconfirmed
What it is

Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths (such as .vscode/tasks.json), enabling auto-execution on folder open.

To remediate this issue, users should upgrade to Kiro IDE version 0.11 or later.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00694 · 52.4th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-06-02T20:16Z
Affected products (1)
ProductVersionsFixed in
amazon/kiro_ide< 0.110.11
References (2)
https://aws.amazon.com/security/security-bulletins/2026-037-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://kiro.dev/changelog/ide/0-11/ · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 02 JUN 15:34Z
    Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths
    cvelistv5