Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme

Bulletin ID:  2026-012-AWS Scope: AWS Content Type:  Important (requires attention) Publication Date: 04/2/2026 11:30 AM PST Description: Kiro IDE is an agentic development environment that makes it easy for developers to ship real engineering work with the help of AI agents. We identified  CVE-2026-5429 , where unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a remote unauthenticated threat actor to execute arbitrary code via a maliciously crafted color theme name when a local user opens the workspace. This issue requires the user to trust the workspace when prompted. Impacted versions:   Resolution: This issue has been addressed in Kiro IDE version 0.8.140 . We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Acknowledgement: We would like to thank Dhiraj Mishra for collaborating on these issues through the coordinated disclosure process. Reference: https://www.cve.org/CVERecord?id=CVE-2026-5429 https://kiro.dev/changelog/ide/0-8/#patch-0-8-140   Please email aws-security@amazon.com with any security questions or concerns.   "},"metadata":{"tags":[]}},{"fields":{"patternBoolean2":"false","id":"ams#rt-rich-textc2#pattern-data"},"metadata":{"tags":[{"name":"pattern-data","description":"Default pattern data","id":"ams#rt-rich-textc2#pattern-data","namespaceId":"rt-rich-text"}]}}]},"metadata":{"auth":{},"testAttributes":{}},"context":{"page":{"pageUrl":"https://aws.amazon.com/security/security-bulletins/2026-012-aws/"},"contentType":"page","environment":{"stage":"prod","region":"us-west-2"},"sdkVersion":"2.0.27"},"refMap":{"manifest.js":"cda3e8d042","rt-rich-text.js":"5043b0a87f","rt-rich-text.rtl.css":"6a04028f86","rt-rich-text.css":"98f5a6aee4","rt-rich-text.css.js":"3d619cc2e1","rt-rich-text.rtl.css.js":"ccdb945d3e"},"settings":{"templateMappings":{"patternHeading":"patternHeading","patternSubheading":"patternSubheading","patternDark":"patternBoolean2","title":"itemHeading","bodyText":"itemLongLoc"}}} CVE-2026-5429 - Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme Bulletin ID:  2026-012-AWS Scope: AWS Content Type:  Important (requires attention) Publication Date: 04/2/2026 11:30 AM PST Description: Kiro IDE is an agentic development environment that makes it easy for developers to ship real engineering work with the help of AI agents. We identified  CVE-2026-5429 , where unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a remote unauthenticated threat actor to execute arbitrary code via a maliciously crafted color theme name when a local user opens the workspace. This issue requires the user to trust the workspace when prompted. Impacted versions:   Resolution: This issue has been addressed in Kiro IDE version 0.8.140 . We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Acknowledgement: We would like to thank Dhiraj Mishra for collaborating on these issues through the coordinated disclosure process. Reference: https://www.cve.org/CVERecord?id=CVE-2026-5429 https://kiro.dev/changelog/ide/0-8/#patch-0-8-140   Please email aws-security@amazon.com with any security questions or concerns.   {"data":{"items":[{"fields":{"footer":"{ "createAccountButtonLabel": "Create an AWS account", "createAccountButtonURL": "https://signin.aws.amazon.com/signup?request_type=register", "backToTopText": "Back to top", "eoeText": "Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability or other legally protected status. Veterans, military spouses, and people with disabilities are encouraged to apply.", "copyrightText": "© 2026, Amazon Web Services, Inc. or its affiliates. All rights reserved.", "items": [

Severity from

no source yet

• aws.amazon.com/security/security-bulletins/rss/2026-012-aws/
• www.cve.org/CVERecord?id=CVE-2026-5429