CVE-2026-10591: Amazon Kiro IDE RCE Vulnerability

CVE-2026-10591 Overview

CVE-2026-10591 is a high-severity access control vulnerability in Amazon Kiro IDE versions before 0.11. The flaw resides in the file write tool, which lacks sufficient restrictions on the paths it can write to. Remote unauthenticated actors can craft instructions that direct the tool to write to execution-sensitive paths such as .vscode/tasks.json. When a developer subsequently opens the affected folder, the IDE auto-executes the planted task, resulting in arbitrary command execution. The issue is tracked under CWE-732: Incorrect Permission Assignment for Critical Resource.

Critical Impact
Attackers can achieve arbitrary command execution on developer workstations through crafted instructions that abuse Kiro IDE's auto-run task behavior on folder open.

Affected Products

Amazon Kiro IDE versions prior to 0.11

Discovery Timeline

2026-06-02 - CVE-2026-10591 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-10591

Vulnerability Analysis

The vulnerability lies in the Kiro IDE file write tool, which does not enforce path-based access control. Attackers leverage this gap to drop attacker-controlled content into IDE configuration files that the editor treats as trusted. Visual Studio Code-compatible IDEs honor .vscode/tasks.json definitions, and Kiro inherits this behavior. When the file declares an auto-run task, opening the folder triggers command execution under the developer's account.

Because Kiro IDE integrates AI-assisted tooling, the file write capability can be invoked through instructions delivered remotely. An attacker who can influence the prompt or content stream provided to the IDE indirectly controls where the tool writes. No interactive authorization is required beyond the user opening the workspace.

Root Cause

The root cause is missing path validation and write-allowlist enforcement within the file write tool. The tool treats execution-sensitive locations like .vscode/tasks.json, .vscode/launch.json, and equivalent configuration files no differently than benign project files. This violates least-privilege design principles for agentic IDE tooling.

Attack Vector

The attack is network-reachable and requires no authentication, though user action is needed to open the affected folder. An attacker delivers crafted instructions that the IDE's file write tool processes. The tool writes a malicious task definition into the workspace. When the developer opens the workspace, the IDE auto-executes the task and the attacker gains code execution in the developer's context. From there, source code, credentials, cloud tokens, and lateral access to development infrastructure are exposed.

No verified public proof-of-concept code is available. See the AWS Security Bulletin 2026-037 for the vendor's technical description.

Detection Methods for CVE-2026-10591

Indicators of Compromise

Unexpected creation or modification of .vscode/tasks.json, .vscode/launch.json, or .vscode/settings.json outside of normal developer activity.
Task definitions invoking shells, curl, wget, powershell, or base64-encoded payloads on folder open.
Child processes spawned by the Kiro IDE process shortly after a workspace is opened.
Outbound network connections from developer workstations to unfamiliar hosts immediately following IDE launch.

Detection Strategies

Monitor file integrity on .vscode/ directories across developer endpoints and flag unauthorized writes.
Alert on Kiro IDE process trees that spawn interpreter or scripting binaries within seconds of process start.
Inspect commits and pull requests for newly introduced tasks.json entries containing shell commands or remote downloads.

Monitoring Recommendations

Centralize endpoint telemetry from developer workstations and correlate IDE process activity with file write and network events.
Review Kiro IDE versions across the fleet and alert on instances running versions earlier than 0.11.
Track outbound egress from developer subnets for known command-and-control patterns originating from IDE child processes.

How to Mitigate CVE-2026-10591

Immediate Actions Required

Upgrade Amazon Kiro IDE to version 0.11 or later on all developer workstations.
Audit existing workspaces for unauthorized .vscode/tasks.json entries before opening any folder with the upgraded IDE.
Revoke and rotate credentials, cloud tokens, and SSH keys cached on workstations that ran vulnerable Kiro versions while handling untrusted content.

Patch Information

Amazon resolved the issue in Kiro IDE version 0.11. Upgrade details are documented in the Kiro Dev Changelog 0.11. The vendor's coordinated advisory is published in the AWS Security Bulletin 2026-037.

Workarounds

Disable automatic task execution on folder open in IDE settings until the patched version is deployed.
Open untrusted repositories in a restricted mode or isolated virtual machine that lacks production credentials.
Apply endpoint allowlisting to prevent IDE child processes from launching unapproved interpreters.
Review and sanitize .vscode/ directories in shared repositories through pre-commit hooks or CI policy checks.

bash

# Verify installed Kiro IDE version and remove vulnerable tasks before reopening workspaces
kiro --version
find . -path '*/.vscode/tasks.json' -print