Introduction
Most developers would not think twice about a color theme name in a shared workspace. In Kiro IDE versions prior to 0.8.140, a crafted one is the entry point for arbitrary code execution. The flaw, tracked as CVE-2026-5429 with a CVSS score of 7.8, turns the IDE's Agent webview into an execution surface when a user opens and trusts a poisoned workspace.
Kiro IDE is an agentic development environment from AWS designed to help developers ship engineering work using integrated AI agents. The platform's 0.8 release cycle introduced features like built-in code intelligence for 18 languages, custom diff tools, and remote authentication. Kiro is an AI-powered IDE gaining traction with developers, so vulnerabilities in its trust boundaries carry implications for any organization adopting agentic development workflows.
Technical Information
The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), which places it in the cross-site scripting (XSS) family. The specific attack surface is the Kiro Agent webview, an embedded browser component within the IDE that renders agent-driven UI elements.
Root Cause
Workspace color theme names were passed directly into the Agent webview's page generation pipeline without proper sanitization. These theme names come from workspace configuration files, which are user-controlled, so an attacker could embed script payloads within the theme name string. When the webview rendered the page, the unsanitized string would break out of its intended data context and be interpreted as executable code.
Attack Flow
The attack runs in six steps:
- The attacker creates a workspace containing a color theme name with an embedded script payload.
- The attacker delivers the malicious workspace to the target through any file-sharing mechanism, such as a Git repository, a shared project template, a zip archive, or something similar.
- The victim opens the workspace in a vulnerable version of Kiro IDE (any version prior to 0.8.140).
- Kiro IDE presents a workspace trust dialog that asks the user whether to trust the environment.
- If the user accepts, Kiro IDE loads the workspace configuration and injects the unsanitized color theme name into the Agent webview.
- The payload executes as arbitrary code within the webview context.
The workspace trust prompt is the only human control point in this chain. The user interaction requirement is a meaningful gate, but it provides limited protection in practice. Developers routinely trust workspaces from colleagues, open source repositories, and shared project templates. Social engineering this step is straightforward in most organizations.
The attacker does not need to be authenticated to any service. The workspace artifact carries the entire attack, which makes this a remote, unauthenticated attack vector with a local execution trigger.
Patch Information
Amazon addressed CVE-2026-5429 in Kiro IDE version 0.8.140, released and publicly disclosed on April 2, 2026. The fix was coordinated through AWS Security Bulletin 2026-012-AWS and is referenced in the vendor's official changelog at kiro.dev/changelog/ide/0-8/#patch-0-8-140.
The patch sanitizes theme name inputs before they are injected into the Agent webview's page generation pipeline. User-controlled strings from workspace configuration can no longer break out of their intended data context and be interpreted as executable code.
Kiro IDE is a closed-source product distributed by AWS, so no public commit diff or pull request is available to show the exact code change. The fix ships as a binary update through Kiro's standard download channels at kiro.dev/downloads. The GitHub repository at github.com/kirodotdev/Kiro is a community issue tracker and does not host source code or release artifacts.
AWS credited security researcher Dhiraj Mishra for the coordinated disclosure.
Organizations running any version of Kiro IDE prior to 0.8.140 should upgrade immediately. Downstream consumers of forked or derivative code that embeds Kiro IDE components must also patch independently to incorporate the fix.
As an interim measure, organizations that cannot patch immediately should instruct developers to deny trust requests for any external or unverified workspace.
Affected Systems and Versions
| Component | Vulnerable Versions | Fixed Version |
|---|---|---|
| Kiro IDE | All versions prior to 0.8.140 | 0.8.140 |
| Kiro Agent webview | All versions prior to 0.8.140 | 0.8.140 |
| Forked or derivative code using Kiro components | Any embedding vulnerable Kiro components | Must patch independently |
The vulnerability affects all Kiro IDE installations running versions older than 0.8.140, regardless of operating system or deployment configuration. The only prerequisite is an active Kiro Agent webview, which is a default component of the IDE.
Vendor Security History
This is the second security bulletin AWS has issued for Kiro IDE in recent months. The earlier bulletin, 2026-009-AWS, addressed CVE-2026-4295, a separate arbitrary code execution flaw triggered by crafted project files. That vulnerability was fixed in version 0.8.0.
The CVE-2026-5429 fix in version 0.8.140 is a later patch within the same 0.8.x release line. Two code execution vulnerabilities in trust boundary handling within a short timeframe suggest that this area of the codebase is undergoing active security hardening. In both cases, user-controlled workspace artifacts were processed with insufficient sanitization, and trusting the workspace led to code execution.
