Kiro IDE Improper Trust Boundary Enforcement Allowing Arbitrary Code Execution
Vulnerability
A vulnerability in Kiro IDE prior to version 0.8.0 on all supported platforms allows remote, unauthenticated threat actors to execute arbitrary code. This issue arises from improper trust boundary enforcement, which enables maliciously crafted project directory files to bypass workspace trust protections. When a local user opens the directory, the crafted files can execute unauthorized code.
Impact
Exploitation of this vulnerability allows for arbitrary code execution on the affected system.
Remediation
Users should upgrade to Kiro IDE version 0.8.0 or higher. The latest version is available on the Kiro website. For those unable to upgrade immediately, it is advised to avoid opening untrusted project directories in Kiro IDE.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.