Vulnerability Description
Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths (such as .vscode/tasks.json), enabling auto-execution on folder open. To remediate this issue, users should upgrade to Kiro IDE version 0.11 or later.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Amazon | Kiro Ide | < 0.11 |
Related Weaknesses (CWE)
References
- https://aws.amazon.com/security/security-bulletins/2026-037-aws/Vendor Advisory
- https://kiro.dev/changelog/ide/0-11/Release Notes
FAQ
What is CVE-2026-10591?
CVE-2026-10591 is a vulnerability with a CVSS score of 8.8 (HIGH). Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions ...
How severe is CVE-2026-10591?
CVE-2026-10591 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-10591?
Check the references section above for vendor advisories and patch information. Affected products include: Amazon Kiro Ide.