CVE-2026-0830 — Command Injection in Kiro GitLab Merge Request Helper
Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when op…
Published: 2026-01-09 · CVSS: 8.4 · CVSS 4.0
Processing specially crafted workspace folder names could allow for arbitrary command injection in the Kiro GitLab Merge-Request helper in Kiro IDE before version 0.6.18 when opening maliciously crafted workspaces. To mitigate, users should update to the latest version.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7