CVE-2026-18656 Amazon CVE debrief

Who should care

Users of Kiro IDE on Windows systems, particularly those exposed to untrusted project directories, should be aware of this vulnerability and take steps to remediate it. This includes verifying their current Kiro IDE version and upgrading to version 1.0.228 or higher if necessary. Additionally, users should monitor for suspicious project directory activity and review their current security controls to ensure they are adequately protected against this type of vulnerability. Security teams and vulnerability management teams should also be aware of this vulnerability and prioritize remediation efforts accordingly. IT operators and administrators responsible for maintaining Kiro IDE installations should take immediate action to verify and remediate affected systems. This vulnerability may pose a significant risk to organizations that rely on Kiro IDE for development purposes, especially those with exposure to untrusted project directories or executables. Affected organizations should consider implementing compensating controls, such as additional monitoring or access restrictions, while remediation is scheduled and verified. Asset inventory and change management processes should be reviewed to ensure that all affected systems are identified and prioritized for remediation. Rollback and change window procedures should also be considered to minimize potential disruptions during remediation. Source tracking and monitoring can help defenders identify potential exploitation attempts and verify the effectiveness of remediation efforts. Overall, a coordinated effort is required across various teams to effectively manage and mitigate this vulnerability. The vulnerability management team should track exceptions, retest remediated assets, and close the item only after evidence is documented. The security team should review relevant monitoring, detection, and logs for exposed assets that need extra review. The IT team should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. They should also confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Compensating controls for

Technical summary

The CVE-2026-18656 vulnerability is an uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows. This might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user opens the directory. The vulnerability has a CVSS score of 8.5 and is classified as HIGH severity. Affected users should verify their Kiro IDE version and upgrade to 1.0.228 or higher to address the vulnerability. The vulnerability was publicly disclosed on 2026-08-04T20:16:50.410Z.

Defensive priority

Users of Kiro IDE on Windows should verify their version and upgrade to 1.0.228 or higher to address the uncontrolled search path element vulnerability.

Recommended defensive actions

• Upgrade Kiro IDE to version 1.0.228 or higher
• Verify Kiro IDE version on Windows systems
• Monitor for suspicious project directory activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE-2026-18656 record indicates an uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows, which might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory. Users should upgrade to version 1.0.228 or higher to remediate this issue. Evidence is limited, and further verification is recommended.

Official resources