An uncontrolled search path vulnerability in Amazon Kiro IDE could allow a local attacker to execute arbitrary code with elevated privileges.

This vulnerability (CWE-427) involves an uncontrolled search path element, where the application improperly manages the location from which it loads executable resources. An unauthenticated local attacker can leverage this by placing malicious files in the search path to influence the application's execution flow.

With a CVSS score of 7.8, this vulnerability presents a high risk for local environments. Exploitation could lead to full compromise of the user account running the IDE, resulting in unauthorized access to source code, project credentials, or other sensitive development data.

Immediate Action: Update Amazon Kiro IDE to version 1.0.228 or later immediately.

Proactive Monitoring: Review file system integrity and monitor for unauthorized file modifications in directories accessible to the IDE application.

Compensating Controls: Restrict write permissions on the directory search paths used by the IDE to ensure that only authorized users can modify files.

Public Exploit Available: No

Development teams should treat this update with high priority to protect their codebase and environment. Ensure all instances of Kiro IDE are updated to the patched version, and verify that appropriate access controls are in place for development workstations.