Bulletin ID: 2026-117-AWSScope: AWSContent Type: Important (requires attention)Publication Date: 09/24/2026 10:00 AM PDTDescription:Kiro is an agentic IDE that users install on their desktop. We identified CVE-2026-95985. The file write tool in Kiro IDE before version 1.0.242 might allow remote unauthenticated actors to execute arbitrary commands and to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths.Impacted versions: < 1.0.242Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.View article