CVE-2026-0830Command Injection in Kiro GitLab Merge Request Helper

Description

Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when opening maliciously crafted workspaces. To mitigate, users should update to the latest version.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• https://kiro.dev/changelog/spec-correctness-and-cli/ patchRelease Notes
• https://aws.amazon.com/security/security-bulletins/2026-001-AWS/ vendor-advisoryVendor Advisory