---
id: CVE-2026-10591
title: Kiro IDE Insufficient File Write Restrictions to Execution-Sensitive Paths
summary: >-
  Insufficient access control restrictions in the file write tool in Amazon Kiro
  IDE before version 0.11 might allow remote unauthenticated actors to execute
  arbitrary commands via crafted instructions that cause writes to
  execution-sensit…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-732
vendor: AWS
product: Kiro IDE
affected:
  - kiro_ide < 0.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-06-02T00:00:00+00:00'
published: '2026-06-02'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T18:08:17.704Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-10591'
references:
  - url: 'https://kiro.dev/changelog/ide/0-11/'
  - url: 'https://aws.amazon.com/security/security-bulletins/2026-037-aws/'
tags:
  - cve.org
epss: 0.00694
epssPercentile: 0.52125
ingestedAt: '2026-10-20T19:16:14.563Z'
---

## Overview

Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths  (such as .vscode/tasks.json), enabling auto-execution on folder open.



To remediate this issue, users should upgrade to Kiro IDE version 0.11 or later.

## Affected

- `kiro_ide < 0.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.