CVE-2026-18656 & CVE-2026-18657 - Issue with Kiro IDE and CLI - Executable Resolution from Untrusted Project Directory on Windows
Summary
Kiro IDE and CLI (software tools that help developers write code) for Windows have a vulnerability where an attacker can trick the program into running malicious code by placing a fake executable in a project directory. When a user opens that directory, Windows searches for programs in the wrong order and runs the attacker's file instead of the legitimate one.
Classification
Affected Vendors
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://aws.amazon.com/security/security-bulletins/rss/2026-074-aws/
First tracked: August 4, 2026 at 08:01 PM
Classified by LLM (prompt v3) · confidence: 85%