CVE-2026-95985 Overview
CVE-2026-95985 affects the file write tool in Amazon Kiro IDE versions before 1.0.242. A remote unauthenticated actor can inject crafted instructions into the agent's context through a malicious repository. When a user opens the repository as an untrusted workspace and sends any message to the agent, the agent can modify auto-loaded global configuration paths under ~/.kiro. The flaw is tracked under CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data and documented in the AWS Security Bulletin 2026-117.
Critical Impact
Attackers can persist malicious instructions into a developer's global Kiro configuration, enabling continued agent manipulation across future sessions and projects.
Affected Products
- Amazon Kiro IDE versions prior to 1.0.242
- Global Kiro configuration directory (~/.kiro) on affected installations
- Developer workstations running the Kiro agent against untrusted repositories
Discovery Timeline
- 2026-09-24 - CVE-2026-95985 published to the National Vulnerability Database
- 2026-09-24 - Last updated in NVD database
- Fix release - Amazon publishes Kiro IDE 1.0.242 with the corrected file write tool, documented in the Kiro Dev IDE Changelog 1.0.242
Technical Details for CVE-2026-95985
Vulnerability Analysis
The Kiro IDE agent integrates a file write tool that executes on behalf of the user when processing agent instructions. In vulnerable versions, the tool does not sufficiently distinguish between trusted user intent and attacker-controlled data loaded from the workspace. An attacker crafts repository content that functions as prompt-injection payload. Once the user opens the repository as an untrusted workspace and sends any message, the injected instructions execute within the agent context. The agent then writes to auto-loaded global configuration paths that persist beyond the current workspace.
Root Cause
The root cause maps to [CWE-349], where untrusted data in the workspace is treated with the same trust level as user-authored instructions. The file write tool lacks a boundary that restricts agent writes to the project scope. As a result, agent-authored writes can reach the global ~/.kiro directory used for configuration auto-loading.
Attack Vector
The attack vector is network-reachable through repository distribution channels such as Git hosting services. The attacker publishes or contributes a repository containing crafted instructions. A victim clones the repository, opens it as an untrusted workspace in Kiro IDE, and sends any prompt to the agent. The agent parses the injected content and performs file writes to global configuration paths. Subsequent sessions auto-load the attacker-controlled configuration, giving the attacker persistence across unrelated projects. See the AWS Security Bulletin 2026-117 for the vendor description.
No verified proof-of-concept code is published. The vulnerability mechanism is described in prose above; no synthetic exploitation code is included.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-95985
Indicators of Compromise
- Unexpected files or modifications inside the global ~/.kiro configuration directory that the user did not author
- New or altered auto-loaded steering, rules, or hooks referencing external URLs, shell commands, or unknown identifiers
- Kiro agent sessions that perform file writes outside the current workspace root shortly after opening a new repository
Detection Strategies
- Baseline the contents of ~/.kiro on developer workstations and alert on changes that do not correlate with user-initiated configuration updates
- Monitor process telemetry for the Kiro IDE binary writing to paths under the user home directory outside the active project
- Review repository onboarding workflows for use of the untrusted-workspace mode on externally sourced code
Monitoring Recommendations
- Forward endpoint file-integrity events for ~/.kiro into the SIEM for retention and correlation
- Track Kiro IDE version strings in asset inventory to identify hosts running versions earlier than 1.0.242
- Correlate first-open events for new Git repositories with subsequent writes to global agent configuration directories
How to Mitigate CVE-2026-95985
Immediate Actions Required
- Upgrade all Kiro IDE installations to version 1.0.242 or later as directed by the Kiro Dev IDE Changelog 1.0.242
- Audit the ~/.kiro directory on any workstation that ran the agent against an untrusted workspace on an earlier version and remove entries the user did not create
- Rotate credentials or tokens that may have been exposed through modified agent configuration
Patch Information
Amazon addressed the vulnerability in Kiro IDE 1.0.242. The fix is documented in the AWS Security Bulletin 2026-117 and the corresponding changelog entry. Users should install the update through the standard Kiro update channel and restart the IDE to ensure the patched file write tool is loaded.
Workarounds
- Avoid opening unverified or third-party repositories as untrusted workspaces in affected Kiro IDE versions
- Review and sanitize repository-level agent instructions, steering files, and hooks before invoking the agent
- Restrict developer workstation file-system permissions so that only expected processes can modify ~/.kiro
# Verify installed Kiro IDE version and inspect global configuration directory
kiro --version
ls -la ~/.kiro
find ~/.kiro -type f -newer ~/.kiro -print
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
