AWS Patches Cross-Site Scripting Flaw in Kiro IDE Webview

AWS released version 0.8.140 of its Kiro IDE on April 2, 2026, to address a cross-site scripting vulnerability identified as CVE-2026-5429. The security bulletin, published at 11:30 AM PST, describes the issue as important and requiring attention from users of the agentic development environment.

The vulnerability exists in the Kiro Agent webview component of the IDE. According to the advisory, unsanitized input during web page generation allows a remote, unauthenticated threat actor to execute arbitrary code. This occurs when a local user opens a workspace that contains a maliciously crafted color theme name.

Technical Context and Disclosure

The flaw specifically impacts how the webview handles color theme names before version 0.8.140. AWS stated that the issue has been addressed in the latest release. The company recommends that users upgrade to the newest version immediately. Additionally, AWS advises that any forked or derivative code must be patched to incorporate the new fixes.

Dhiraj Mishra discovered the vulnerability and collaborated with AWS through the coordinated disclosure process. The security team thanked Mishra for his assistance in resolving the issue. The official CVE record is available at cve.org for further technical reference.

Affected Users and Requirements

The attack vector requires a specific user interaction to succeed. According to the AWS security bulletin, the issue requires the user to trust the workspace when prompted. Without this trust action, the malicious color theme cannot trigger the code execution. This means the vulnerability is not exploitable against users who do not open or trust compromised workspaces.

Kiro IDE is described by AWS as an agentic development environment designed to help developers ship engineering work with AI assistance. Users of this tool should verify their current version number. Any installation running a version earlier than 0.8.140 is considered vulnerable to CVE-2026-5429.

What should you do?

Administrators and developers using Kiro IDE should check their current version against the 0.8.140 threshold. If an older version is detected, an update should be applied as soon as possible. Users should also review any custom or forked versions of the IDE to ensure they include the necessary security patches.

What to do and how to stay safe: AWS

• Verify the installed version of Kiro IDE and update to 0.8.140 or later if an older version is present.
• Audit any forked or derivative versions of the IDE to ensure they incorporate the security fixes for CVE-2026-5429.
• Exercise caution when opening workspaces from untrusted sources, as exploitation requires trusting the workspace.
• Monitor AWS security bulletins and the Kiro changelog for future updates or related security advisories.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-5429?

It is a cross-site scripting vulnerability in Kiro IDE before version 0.8.140 that allows arbitrary code execution via malicious color themes.

How is the vulnerability exploited?

An unauthenticated remote attacker can exploit it by crafting a malicious color theme name, which executes code when a user trusts and opens the workspace.

Is there a fix available?

Yes, AWS released version 0.8.140 on April 2, 2026, which addresses the issue. Users should upgrade to this version or later.