CVE-2026-10591: Amazon Kiro IDE Remote Code Execution via Unsafe File Write

Technical summary

The vulnerability stems from insufficient access control in Kiro IDE's file write tool (CWE-732: Improper Restriction of Rendered UI Layers or Frames). Before version 0.11, the tool does not adequately validate or restrict write operations to execution-sensitive paths. An attacker can craft malicious instructions that cause the IDE to write to files like .vscode/tasks.json, which VS Code automatically executes when a workspace is loaded. The attack vector is network-based, requires minimal complexity, and only needs user interaction (opening a folder), making it practical to exploit in real-world scenarios.

Business impact

A successful exploit allows arbitrary code execution on a developer's machine with the privileges of the IDE process. Attackers can steal source code, credentials, SSH keys, and environment secrets; inject malicious code into projects; establish persistence; or pivot to other systems on the developer's network. Teams managing shared or open-source projects face additional risk if contributors unknowingly open malicious project folders. The impact extends beyond individual developers to supply chain integrity, particularly if compromised projects are distributed downstream.

Affected systems

Amazon Kiro IDE versions prior to 0.11 are vulnerable. This affects development environments where Kiro IDE is installed, regardless of underlying OS, since the vulnerability is in the IDE's cross-platform file write logic. Developers who have not yet patched are at direct risk.

Exploitability

Exploitability is high. The attack requires no authentication, no special user privileges, and only social engineering or accidental interaction (opening a project folder). The CVSS score of 8.8 reflects this: network-accessible, low attack complexity, and high impact across confidentiality, integrity, and availability. No known public exploits are listed in CISA's KEV catalog, but the straightforward nature of the flaw means exploit code could be developed or weaponized quickly.

Remediation

Upgrade Amazon Kiro IDE to version 0.11 or later immediately. This patch restricts file write operations and prevents writes to execution-sensitive paths. Users should also review recent project folders they have opened for any unexpected task configuration files or suspicious entries in .vscode/tasks.json. Consider running a malware scan on affected systems and rotating any credentials or keys that may have been present in the development environment.

Patch guidance

Consult the official Amazon Kiro IDE release notes and update mechanism for version 0.11 or later. Verify the update signature and source to ensure you are downloading a legitimate patch. Organizations should test the patch in a non-production environment first, then deploy via their standard update process. For teams using multiple developer machines, consider automating or enforcing the update across all endpoints to prevent gaps in coverage.

Detection guidance

Monitor Kiro IDE file write operations and log any writes to .vscode/ directories, launch.json, tasks.json, or other execution-sensitive paths. Examine project folders for unexpected .vscode/tasks.json entries or suspicious shell commands within task definitions. Review IDE logs for unusual file write attempts originating from network instructions. Watch for indicators of compromise on developer machines, such as new network connections, unexpected process spawning, or exfiltration of source code or credentials. Network-based detection should flag requests that attempt to instruct Kiro IDE to write to sensitive paths.

Why prioritize this

This vulnerability should be treated as high-priority. It enables unauthenticated remote code execution on developer machines through a low-friction attack (opening a folder), with no exploitation barriers. Even without active KEV listing, the combination of high CVSS (8.8), ease of exploitation, and direct impact on code integrity and secrets makes rapid patching essential. Organizations with developers using Kiro IDE should prioritize this update within their patch management cycle.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) is justified by: network attack vector (AV:N) requiring no authentication (PR:N), low attack complexity (AC:L), minimal user interaction (UI:R—just opening a folder), and high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The attack does not require privilege escalation or access to other systems (S:U). The score appropriately reflects the real-world severity: a remote attacker can achieve code execution on a developer's machine with only social engineering or accidental interaction.

Frequently asked questions