CVE-2026-0830 - Command Injection in Kiro GitLab Merge Request Helper

unknownCVE-2026-0830

Bulletin ID: 2026-001-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/01/09 13:15 PM PST Description: Kiro is an agentic IDE users install on their desktop. We identified CVE-2026-0830 where opening a maliciously crafted workspace may lead to arbitrary command injection in Kiro IDE before Kiro version 0.6.18. This may occur if the workspace has specially crafted folder names within the workspace containing injected commands. Resolution: Kiro IDE <0.6.18 Please refer to the article below for the most up-to-date information related to this AWS Security Bulletin.

CSIRTS triage

vendor: Kiro product: Kiro IDE Remote code executionOtheraffected: < 0.6.18

What: Opening a maliciously crafted workspace may lead to arbitrary command injection.
Who is affected: Users of Kiro IDE versions before 0.6.18.
Urgency: Remediation is urgent due to the potential for arbitrary command execution.
Action: Upgrade to Kiro IDE version 0.6.18 or later.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Kiro IDE

Get an email when a new Kiro IDE advisory drops — max one per day, one-click unsubscribe.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-06-05
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-001-aws/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2026-08301.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 67% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-0830	coverage & exploitation status	NVD · CVE.org

Recent advisories for - Command Injection

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-4661: The WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales plugin for WordPress is vulnerab…nvd · 2026-07-11
highCVE-2026-15155: The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPres…nvd · 2026-07-11
mediumCVE-2025-5017: The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQ…nvd · 2026-07-11
highCVE-2026-15335: The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Fo…nvd · 2026-07-11
mediumCVE-2026-15073: The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to …nvd · 2026-07-11
mediumCVE-2026-15072: The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to …nvd · 2026-07-11