CVE-2026-0830 - Command Injection in Kiro GitLab Merge Request Helper

unknownCVE-2026-0830

Bulletin ID: 2026-001-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/01/09 13:15 PM PST Description: Kiro is an agentic IDE users install on their desktop. We identified CVE-2026-0830 where opening a maliciously crafted workspace may lead to arbitrary command injection in Kiro IDE before Kiro version 0.6.18. This may occur if the workspace has specially crafted folder names within the workspace containing injected commands. Resolution: Kiro IDE <0.6.18 Please refer to the article below for the most up-to-date information related to this AWS Security Bulletin.

CSIRTS triage

vendor: Kiro product: Kiro IDE Remote code executionOtheraffected: < 0.6.18

What: Opening a maliciously crafted workspace may lead to arbitrary command injection.
Who is affected: Users of Kiro IDE versions before 0.6.18.
Urgency: Remediation is urgent due to the potential for arbitrary command execution.
Action: Upgrade to Kiro IDE version 0.6.18 or later.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Kiro IDE

Get an email when a new Kiro IDE advisory drops — max one per day, one-click unsubscribe.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-08-20
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-001-aws/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2026-08301.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 68% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-0830	coverage & exploitation status	NVD · CVE.org

Recent advisories for - Command Injection

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-38472: A Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) commit 86…nvd · 2026-08-25
unknownCVE-2026-38468: A SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterW…nvd · 2026-08-25
unknownCVE-2026-38467: A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4…nvd · 2026-08-25
unknownCVE-2026-79249: Code injection in Bisection in Google Chrome prior to 152.0.7977.65 allowed a remote attacker …nvd · 2026-08-25
unknownCVE-2026-79234: Injection in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentia…nvd · 2026-08-25
unknownCVE-2026-79087: Injection in Chrome Tabs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to …nvd · 2026-08-25