CVE-2026-4295

HIGH EPSS 10.8%

Published Mar 17, 20263mo ago · Modified Mar 18, 20263mo ago

8.5 CVSS 4.0

High

Published Mar 17, 2026 3mo ago

Last Modified Mar 18, 2026 3mo ago

Description

Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote unauthenticated threat actor to execute arbitrary code via maliciously crafted project directory files that bypass workspace trust protections when a local user opens the directory. To remediate this issue, users should upgrade to version 0.8.0 or higher.

CVSS Details

Base Score

8.5

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Local

Attack Complexity Low

Privileges Required None

User Interaction P

Scope X

Threat Intelligence

EPSS Exploit Probability

10.8% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-829

References 2

aws.amazon.com https://aws.amazon.com/security/security-bulletins/2026-009-AWS/
kiro.dev https://kiro.dev/changelog/ide/0-8/

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.