CVE-2026-0830Command Injection in Kiro GitLab Merge Request Helper

Beschreibung

Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when opening maliciously crafted workspaces. To mitigate, users should update to the latest version.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• https://kiro.dev/changelog/spec-correctness-and-cli/ patchRelease Notes
• https://aws.amazon.com/security/security-bulletins/2026-001-AWS/ vendor-advisoryVendor Advisory