7.8
Élevée
CVE-2026-5429 Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a…
Description
Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a remote unauthenticated threat actor to execute arbitrary code via a potentially damaging crafted color theme name when a local user opens the workspace. This issue requires the user to trust the workspace when prompted. To remediate this issue, users should upgrade to version 0.8.140.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Kiro IDE 0.1 | 0.1 → < 0.8.140 | 0.8.140 |
Références
- aws.amazon.com aws.amazon.com
- kiro.dev kiro.dev
Chronologie
- Publiée
- Dernière modification
Autres CVE de Kiro IDE
Les 6 CVE de Kiro IDE →
CVE-2026-89332
Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version…
5.5
Moyenne
CVE-2026-11931
Incorrect default permissions in Kiro IDE on macOS and Linux before version 0.11.133 could expose the authentication…
6.8
Moyenne
CVE-2026-10591
Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow…
8.8
Élevée
CVE-2026-4295
Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote…
7.8
Élevée