CVE-2026-0830
Bulletin ID: 2026-001-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 2026/01/09 13:15 PM PST Description: Kiro is an agentic IDE users install on their desktop. We identified CVE-2026-0830 where opening a maliciously crafted workspace may lead to arbitrary command injection in Kiro IDE before Kiro version 0.6.18. This may occur if the workspace has specially crafted folder names within the workspace containing injected commands. Resolution: Kiro IDE <0.6.18 Please refer to the article below for the most up-to-date information related to this AWS Security Bulletin.
CSIRTS triage
- What
- Opening a maliciously crafted workspace may lead to arbitrary command injection.
- Who is affected
- Users of Kiro IDE versions before 0.6.18.
- Urgency
- Remediation is urgent due to the potential for arbitrary command execution.
- Action
- Upgrade to Kiro IDE version 0.6.18 or later.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-0830
Get an email if CVE-2026-0830 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Moderate exploitation risk1.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 67% of all EPSS-scored CVEs.
Advisory coverage (1)
- unknownCVE-2026-0830 - Command Injection in Kiro GitLab Merge Request Helperaws · 2026-06-05
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-0830)