CVE-2026-0830 - Command Injection in Kiro GitLab Merge Request Helper

unknownCVE-2026-0830

Bulletin ID: 2026-001-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/01/09 13:15 PM PST Description: Kiro is an agentic IDE users install on their desktop. We identified CVE-2026-0830 where opening a maliciously crafted workspace may lead to arbitrary command injection in Kiro IDE before Kiro version 0.6.18. This may occur if the workspace has specially crafted folder names within the workspace containing injected commands. Resolution: Kiro IDE <0.6.18 Please refer to the article below for the most up-to-date information related to this AWS Security Bulletin.

CSIRTS triage

vendor: Kiro product: Kiro IDE Remote code executionOtheraffected: < 0.6.18

What: Opening a maliciously crafted workspace may lead to arbitrary command injection.
Who is affected: Users of Kiro IDE versions before 0.6.18.
Urgency: Remediation is urgent due to the potential for arbitrary command execution.
Action: Upgrade to Kiro IDE version 0.6.18 or later.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Kiro IDE

Get an email when a new Kiro IDE advisory drops — max one per day, one-click unsubscribe.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-08-20
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-001-aws/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2026-08301.5% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 72% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-0830	coverage & exploitation status	NVD · CVE.org

Recent advisories for - Command Injection

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-85198: The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress …nvd · 2026-09-12
highCVE-2026-78175: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP…nvd · 2026-09-12
mediumCVE-2026-77161: The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQ…nvd · 2026-09-12
highCVE-2026-16482: The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-b…nvd · 2026-09-12
mediumGHSA-98q5-5qh2-7w75: Central Dogma: LDAP injection in SearchFirstActiveDirectoryRealm enables authentication c…ghsa · 2026-09-11
unknownCVE-2026-52630: SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to upda…nvd · 2026-09-11