CVE-2026-0830Command Injection in Kiro GitLab Merge Request Helper

Açıklama

Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when opening maliciously crafted workspaces. To mitigate, users should update to the latest version.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• https://kiro.dev/changelog/spec-correctness-and-cli/ patchRelease Notes
• https://aws.amazon.com/security/security-bulletins/2026-001-AWS/ vendor-advisoryVendor Advisory