CVE-2026-0830Command Injection in Kiro GitLab Merge Request Helper

Descripción

Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when opening maliciously crafted workspaces. To mitigate, users should update to the latest version.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://kiro.dev/changelog/spec-correctness-and-cli/ patchRelease Notes
• https://aws.amazon.com/security/security-bulletins/2026-001-AWS/ vendor-advisoryVendor Advisory