What is GHSA-vr58-qjgp-x52v?

GHSA-vr58-qjgp-x52v is a security advisory published by GitHub Security Advisories with High severity. An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a...

Which CVE IDs does GHSA-vr58-qjgp-x52v cover?

GHSA-vr58-qjgp-x52v covers the following CVE IDs: CVE-2026-18657. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vr58-qjgp-x52v?

GHSA-vr58-qjgp-x52v has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

GHSA-vr58-qjgp-x52vHighCVSS 7.8

An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a...

Vendor

GitHub Security Advisories

Published

August 4, 2026

Last Modified

August 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-18657 →

📋 Description

An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in the directory.

To remediate this issue, users should upgrade to version 2.10.0 or higher.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-18657
https://aws.amazon.com/security/security-bulletins/2026-074-aws
https://kiro.dev/changelog/cli/2-10
https://github.com/advisories/GHSA-vr58-qjgp-x52v