The EPSS score of 0.00159 for CVE-2026-18657 likely understates this vulnerability's practical risk. The CVSS 7.8 rating captures potential severity correctly, but the framing of 'remote unauthenticated actor' paired with the low EPSS score implies this requires active victim manipulation — cloning a malicious repo, extracting a tainted archive, or accessing a compromised network share. In reality, the attack surface is the developer's routine workflow: cloning external repositories, running tooling from within those directories, and automated CI/CD pipelines pulling and building code from untrusted sources. The 'remote actor' in these scenarios need not interact with the victim at all beyond hosting the poisoned project.
The phrase 'bypasses workspace trust protections' deserves specific attention. Modern editors like VS Code and JetBrains warn before executing code in untrusted directories — this is an explicit security boundary that users rely on. This CVE indicates Kiro CLI can be invoked in a way that circumvents those safeguards, meaning a developer's safety assumptions about their IDE are rendered incomplete by CLI invocation. The threat model isn't just 'a user runs a malicious tool' — it's 'a developer's tooling trust model has an undocumented escape hatch.'
The 2.10.0 patch presumably adds path hardening or executable validation, but the disclosure lacks detail on which search paths were vulnerable and what trust signals Kiro now validates. Three questions warrant investigation: whether the fix addresses direct CLI invocation, API calls, and subprocess spawning equally; whether other tooling in the Kiro ecosystem (plugins, extensions, editor integrations) share the same vulnerable search behavior; and whether the fix targeted only the demonstrated Windows trigger or audited the broader search path enumeration logic across platforms.
For defenders: prioritize this in CI/CD environments where build pipelines clone external repositories and invoke local tooling. The low EPSS score reflects a threat model that doesn't match how these attacks actually propagate through supply chains. Consider artifact signing and sandboxed execution for any workflow that pulls code from untrusted sources.