Skip to content
fr Sign in
7.8 High

CVE-2026-5429 Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a…

Description

Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a remote unauthenticated threat actor to execute arbitrary code via a potentially damaging crafted color theme name when a local user opens the workspace. This issue requires the user to trust the workspace when prompted. To remediate this issue, users should upgrade to version 0.8.140.

Affected products and versions

Product Affected versions Fixed in
Kiro IDE 0.1 0.1 → < 0.8.140 0.8.140

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Kiro IDE

The 6 CVEs of Kiro IDE →
CVE-2026-89332 Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version… 5.5 Medium CVE-2026-11931 Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication… 6.8 Medium CVE-2026-10591 Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow… 8.8 High CVE-2026-4295 Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote… 7.8 High
Track this CVE