What is GHSA-hhmj-6g9r-9vvq?

GHSA-hhmj-6g9r-9vvq is a security advisory published by GitHub Security Advisories with High severity. An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a...

Which CVE IDs does GHSA-hhmj-6g9r-9vvq cover?

GHSA-hhmj-6g9r-9vvq covers the following CVE IDs: CVE-2026-18656. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hhmj-6g9r-9vvq?

GHSA-hhmj-6g9r-9vvq has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

GHSA-hhmj-6g9r-9vvqHighCVSS 7.8

An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a...

Vendor

GitHub Security Advisories

Published

August 4, 2026

Last Modified

August 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-18656 →

📋 Description

An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user opens the directory.

To remediate this issue, users should upgrade to version 1.0.228 or higher.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-18656
https://aws.amazon.com/security/security-bulletins/2026-074-aws
https://kiro.dev/changelog/ide/1-0/#patch-1-0-228
https://github.com/advisories/GHSA-hhmj-6g9r-9vvq