CVE-2026-0830 Details
Description
Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when opening maliciously crafted workspaces. To mitigate, users should update to the latest version.
A command injection vulnerability has been identified in the Kiro GitLab Merge-Request helper, present in Kiro IDE versions prior to 0.6.18. The issue arises when the application processes workspace folder names that have been specially crafted to include injected commands, allowing for arbitrary command execution.
Users are advised to update Kiro IDE to version 0.6.18 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://aws.amazon.com/security/security-bulletins/2026-001-AWS/ | AMZN | Vendor Advisory |
| https://kiro.dev/changelog/spec-correctness-and-cli/ | AMZN | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | AMZN |
Affected Products
| Product | Versions |
|---|---|
| amazon kiro ide | < 0.6.18 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | AMZN |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 28, 2026 | Initial Analysis | [email protected] |
| Jan 9, 2026 | CVE Modified | AMZN |
| Jan 9, 2026 | New CVE Received | AMZN |