TI-2026-04754 Aliases CVE-2026-5429 GHSA-7v7j-vpv5-h468

Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme

LOW 32CWE-79Published 2026-04-02 · Updated 2026-04-02

Key facts

Attack vector: Local
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: Present
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a remote unauthenticated threat actor to execute arbitrary code via a potentially damaging crafted color theme name when a local user opens the workspace. This issue requires the user to trust the workspace when prompted. To remediate this issue, users should upgrade to version 0.8.140.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00164 5th percentileScored 2026-11-07

Fix Fixed Kiro IDE (AWS): 0.8.140

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
AWS	Kiro IDE	0.1 to before 0.8.140	0.8.140	Patch available	CNA

Kiro IDE VendorAWS Affected 0.1 to before 0.8.140 Fixed in 0.8.140 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:amazon:kiro_ide::::::::	—	—	AWS

cpe:2.3:a:amazon:kiro_ide:*:*:*:*:*:*:*:* Versions — — ·AWS

Remediation

Fix · CNA Kiro IDE (AWS) Fixed in 0.8.140

Timeline

2026-10-02 Threatist record created from CVE-2026-5429
2026-10-03 Alias added: GHSA-7v7j-vpv5-h468

References

Advisory 1

https://aws.amazon.com/security/security-bulletins/2026-012-aws/

Other 1

https://kiro.dev/changelog/ide/0-8/#patch-0-8-140

TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2024-18648 Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM… CVSS 3.1CRITICAL 9.8
TI-2024-05929 Openssh: regresshion - race condition in ssh allows rce/dos CVSS 3.1HIGH 8.1
TI-2025-03847 Input validation issue in AWS Amplify Studio UI component properties CVSS 4.0CRITICAL 9.0
TI-2026-11603 HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF CVSS 4.0HIGH 7.9

See all 383 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences