CVE-2026-95985

Summary

This vulnerability allows remote unauthenticated actors to inject malicious instructions into the agent's context, potentially leading to unauthorized modifications of global configurations.

Exploitability

Exploitation requires running the agent in an untrusted workspace with a crafted repository, making it moderately difficult.

Blast radius

If exploited, the impact could be high, as it could lead to unauthorized changes in global configurations affecting the entire system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Kiro IDE version 1.0.242 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.