CVE-2026-112380

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112380
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112380.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112380
Aliases
  • GHSA-x4jf-p42g-q3hc
Published
2026-10-20T20:05:28Z
Modified
2026-10-21T10:53:40Z
Severity
  • 9.0 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
Missing authorization in the WhatsApp channel in Kiro Crew
Details

Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host running Kiro Crew via messages sent to the group.

To remediate this issue, users should upgrade to version 0.7.2.

Database specific 
{
    "cna_assigner":  "AMZN",
    "cwe_ids":  [
        "CWE-862",
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112380.json"
}
References

Affected packages

Git / github.com/kirodotdev/kirocrew

Affected ranges

Type
GIT
Repo
https://github.com/kirodotdev/kirocrew
Events
Introduced
6603d596c375ad9f1f5e6475b7c9a7c4fc83a7e1
Last Affected
6287f540aef70e197657947e6530702ad74233f9
Fixed
c67c5060a82faf6e5e1bc06077122c473d4ca456
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.4.0"
                },
                {
                    "last_affected":  "0.7.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "original_tag":  "v0.7.2",
            "range":  [
                {
                    "fixed":  "c67c5060a82faf6e5e1bc06077122c473d4ca456"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112380.json"