CVE-2026-5429 - Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme

Summary

CVE-2026-5429 affects Kiro IDE before version 0.8.140. Unsanitized input during web page generation in the Kiro Agent webview lets a remote unauthenticated attacker run arbitrary code through a maliciously crafted color theme name when a local user opens the workspace. The user must trust the workspace when prompted.

Mitigation

Fixed in 0.8.140 or later.

Related items

• HighCVE-2026-105812 and CVE-2026-106032: Issue with Bedrock AgentCore Starter Toolkit - Import Agent Code Injection and SSRFSame vendor · AWS Security Bulletins
• HighCVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker DistributionSame vendor · AWS Security Bulletins
• CriticalCVE-2026-103956, CVE-2026-103957, and CVE-2026-103958 - Issues in Loom for AWSSame vendor · AWS Security Bulletins
• HighCVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scanSame vendor · AWS Security Bulletins
• HighGHSA-6v3r-4p5c-mrp5: Language Servers for AWS vulnerable to arbitrary file writeSame vendor · GitHub Advisory Database