CVE-2026-95985

Executive Summary

CVE-2026-95985 is a content-spoofing / insufficiently-trusted-context vulnerability (CWE-349) in the file write tool of Amazon Kiro IDE versions before 1.0.242. When a user opens a crafted repository as an untrusted workspace and runs the agent, a remote unauthenticated actor can cause crafted instructions to be injected into the agent's context, resulting in unauthorized modifications to auto-loaded global configuration paths. With a CVSS base score of 8.8 (High), exploitation requires user interaction (running the agent in a malicious workspace) but yields high confidentiality, integrity, and availability impact, including potential compromise of the agent's global configuration.

Technical Analysis

The vulnerability resides in the interaction between two Kiro IDE subsystems: the agent's context-injection mechanism and the file write tool that the agent uses to persist changes. Per the NVD description, the file write tool "might allow remote unauthenticated actors to inject crafted instructions into the agent's context." The root cause is classified as CWE-349 — "Acceptance of Extraneous Untrusted Data With Trusted Data." In practical terms, content that originates from an untrusted workspace (the crafted repository) is not sufficiently separated or sanitized before it is combined with trusted context that the agent acts upon. Because the agent treats the combined context as trusted, it can be induced to perform file write operations against "auto-loaded global configuration paths."

Key characteristics derivable from the description:

• Attack surface: A repository/workspace that the user opens in Kiro IDE and designates (or leaves as) untrusted. The workspace supplies attacker-controlled content that is consumed by the agent.
• Trigger: The user "sending any message" while the agent runs in that workspace. This suggests the injection is realized during the agent's normal request-processing loop rather than through a discrete, separately-supplied exploit payload.
• Trust boundary failure: Data from the untrusted workspace crosses into the trusted instruction set the agent executes. The agent's file write tool is the mechanism by which resulting changes are written to disk.
• Target of impact: "Global configuration paths" that are auto-loaded by Kiro. The NVD description identifies the global Kiro configuration directory as ~/.kiro. The advisory recommends that users who ran the agent in an untrusted workspace on affected versions review ~/.kiro for entries they did not create.

The description uses permissive language ("might allow"), which is consistent with a vulnerability disclosed without a fully detailed root-cause write-up. No public PoC, exploit code, or Nuclei template is available. No specific function names, class names, URL endpoints, or API parameters are provided in the source data, and none should be assumed. The attack mechanism is therefore best characterized at the vulnerability-class level: untrusted repository content is incorporated into the agent's context and causes the agent to write attacker-influenced changes to global configuration locations that are automatically loaded.

CVSS subscores indicate: network attack vector (AV:N), low complexity (AC:L), no privileges required for the remote actor (PR:N), but user interaction required (UI:R — running the agent in the crafted workspace and sending a message), and scope unchanged (S:U). Confidentiality, integrity, and availability impacts are all High (C:H/I:H/A:H), reflecting that global configuration modification can affect the agent across all subsequent sessions in the user's environment.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-349) and the behavioral description in the NVD advisory.

1. Reconnaissance / target identification. The attacker identifies or assumes the presence of Kiro IDE users who consume third-party code. Targets are any users who clone or open external repositories and run the Kiro agent against them. The attacker's delivery surface is the repository content itself — READMEs, configuration files, documentation, or any other repository-resident content the agent ingests.

2. Triggering the flaw class. The attacker crafts a repository that, when opened as an untrusted workspace, places content into the material the agent loads into its context. The precise encoding is not documented in the advisory, but at the class level the attacker embeds text designed to be interpreted as agent instructions (prompt-injection-style content) within workspace files. The victim must then run the agent in that workspace. Per NVD, "sending any message can cause agent modifications to auto-loaded global configuration paths" — meaning no special user action beyond normal agent use is required once the crafted workspace is active.

3. Payload / execution method (class level). The crafted content is interpreted by the agent as trusted instruction data. Leveraging the file write tool, the agent then modifies auto-loaded global configuration paths. The specific files written are not named in the advisory beyond the global configuration directory ~/.kiro. The attacker does not need credentials or direct network access to the victim's machine; the repository itself is the delivery vehicle.

4. Post-exploitation impact. Modified global configuration is auto-loaded, so attacker-influenced configuration can persist and apply to subsequent Kiro agent sessions, not just the session in which the malicious workspace was used. This can alter agent behavior, affect what the agent reads or writes, and (given High C/I/A) degrade the confidentiality, integrity, and availability of the user's development environment. The advisory's remediation note — reviewing ~/.kiro for entries the user did not create — confirms the persistence mechanism and indicates users must actively audit for unauthorized configuration entries.

Impact Assessment

The CVSS base score is 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

• Attack vector (N): Repository delivery is network-mediated; the attacker need not be on the local network.
• Attack complexity (L) and privileges (N): No special conditions or authentication are cited for the remote actor.
• User interaction (R): Exploitation depends on a user opening the crafted repository as an untrusted workspace and running the agent (sending a message).
• Scope (U): Impact remains within the same security authority.
• C/I/A (all High): Modification of auto-loaded global configuration affects all sessions where that configuration is consumed, giving the incident a persistence property beyond a single interaction.

Business impact: Affected users are developers and teams using Kiro IDE prior to 1.0.242 on untrusted repositories. The blast radius is per-workstation but persistent: because the modified global configuration is auto-loaded, downstream agent actions in later projects can be influenced by the attacker's changes. This elevates the risk to source code integrity, secrets handling, and any automation the agent performs. EPSS is not yet scored by FIRST.org; CISA KEV does not list this CVE. No known in-the-wild exploitation is documented in the provided data.

Detection Guidance

Detection should focus on two layers: (1) unexpected writes to Kiro's auto-loaded global configuration directory (~/.kiro), and (2) repository content consistent with injecting instructions into an AI agent's context.

Sigma Rule

title: Kiro IDE Agent Unauthorized Global Configuration Modification (CVE-2026-95985)
id: 3f9a1c7e-2b64-4d3e-9a11-9c0e5b7d41aa
status: experimental
description: Detects file writes to the Kiro IDE global configuration directory (~/.kiro) that may indicate exploitation of CVE-2026-95985, where a crafted untrusted workspace causes the agent to modify auto-loaded global configuration paths.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95985
author: valtersit.com
date: 2026/01/01
logsource:
  category: file_event
  product: windows
detection:
  selection_kiro_dir:
    TargetFilename|contains:
      - '\.kiro\'
      - '/.kiro/'
  selection_write:
    EventType:
      - 'Create'
      - 'Write'
      - 'Modify'
  condition: selection_kiro_dir and selection_write
falsepositives:
  - Legitimate Kiro configuration changes made by the user directly
  - Kiro installers or updaters writing default configuration
level: medium
tags:
  - attack.t1195
  - cve.2026.95985

YARA Rule

rule Kiro_Agent_Context_Injection_CVE_2026_95985
{
    meta:
        description = "Detects agent-instruction injection strings within repository-resident content targeting Kiro IDE (CVE-2026-95985). Review hits before treating as malicious."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95985"
        date = "2026-01-01"
        severity = "high"

    strings:
        $a1 = "ignore previous instructions" nocase
        $a2 = "ignore all previous instructions" nocase
        $a3 = "when the agent runs" nocase
        $a4 = "write the following to" nocase
        $a5 = "append to ~/.kiro" nocase
        $a6 = "add to global configuration" nocase
        $a7 = "modify ~/.kiro" nocase
        $a8 = ".kiro/config" nocase

    condition:
        uint32(0) != 0x646e450a and
        (2 of ($a*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-95985 Possible Kiro IDE Agent Context Injection via Crafted Workspace Content"; flow:established,to_server; http.request_body; content:"ignore previous instructions"; nocase; content:".kiro"; nocase; distance:0; within:2048; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-user; reference:cve,2026-95985; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-95985; sid:2026095985; rev:1;)

Elastic Detection

file where event.action in ("creation", "modification") and
  file.path : ("*/.kiro/*", "*\\.kiro\\*") and
  not process.name in ("Kiro.exe", "kiro-setup.exe", "kiro")

Splunk SPL Query

index=endpoint OR index=sysmon (EventCode=11 OR EventCode=1)
| eval target=coalesce(TargetFilename, Image)
| where like(target, "%\\.kiro\\%") OR like(target, "%/.kiro/%")
| stats count min(_time) as first_seen max(_time) as last_seen
    values(Image) as processes values(User) as users by host target
| where count >= 1
| eval severity=if(count > 3, "HIGH", "MEDIUM")
| table first_seen last_seen host users processes target count severity
| sort - count

Wazuh OSSEC Rule

<group name="kiro,cve-2026-95985,">
  <rule id="120959" level="10">
    <if_sid>550</if_sid>
    <field name="file">\.kiro[\\/]</field>
    <description>CVE-2026-95985: Possible Kiro IDE global configuration modification - review ~/.kiro for unauthorized entries</description>
    <mitre>
      <id>T1195</id>
    </mitre>
  </rule>
  <rule id="120960" level="8">
    <if_sid>554</if_sid>
    <field name="file">\.kiro[\\/]</field>
    <description>CVE-2026-95985: Kiro IDE global configuration written - verify change was user-initiated</description>
    <mitre>
      <id>T1195</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Upgrade Kiro IDE to version 1.0.242 or later as directed by the advisory.
   • Do not run the Kiro agent in untrusted workspaces on versions before 1.0.242. Treat any repository of unknown provenance as untrusted.
   • If the agent was previously run in an untrusted workspace on an affected version, review the global Kiro configuration directory (~/.kiro) and remove any entries the user did not create. Unauthorized entries may persist and be auto-loaded in subsequent sessions.
   • Restrict write permissions to ~/.kiro where operationally feasible, and monitor that path for unexpected changes (see Detection Guidance).

2. Patch / upgrade steps

   • Update Kiro IDE to 1.0.242 or later through the vendor's normal update channel.
   • After upgrading, re-audit ~/.kiro to confirm no residual attacker-influenced configuration remains, since upgrading does not retroactively clean modified global configuration.

3. Long-term hardening

   • Adopt an agent trust model that treats workspace-derived content as untrusted data, never as instructions, and enforce separation between repository content and agent control logic.
   • Require explicit user confirmation before the agent writes to global, auto-loaded configuration paths; scope agent file writes to the workspace by default.
   • Establish periodic integrity baselining of agent configuration directories and integrate change alerts into SOC monitoring.
   • Apply least-privilege filesystem permissions to agent processes and their configuration directories.

References

• NVD — CVE-2026-95985: https://nvd.nist.gov/vuln/detail/CVE-2026-95985
• CWE-349 — Acceptance of Extraneous Untrusted Data With Trusted Data: https://cwe.mitre.org/data/definitions/349.html
• MITRE ATT&CK — T1195 Supply Chain Compromise: https://attack.mitre.org/techniques/T1195/
• MITRE ATT&CK — T1204.002 User Execution: Malicious File: https://attack.mitre.org/techniques/T1204/002/
• Amazon Kiro IDE — vendor product information and update channel: https://kiro.dev/

No public PoC, exploit code, or Nuclei template is available for CVE-2026-95985. No exploit-in-the-wild evidence or associated threat actor campaign is documented in the provided data, and the CVE is not listed in CISA KEV. EPSS has not yet assigned a score by FIRST.org.