CVE-2026-5429

HIGH

Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme

Title source: cna
STIX 2.1

Description

Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a remote unauthenticated threat actor to execute arbitrary code via a potentially damaging crafted color theme name when a local user opens the workspace. This issue requires the user to trust the workspace when prompted. To remediate this issue, users should upgrade to version 0.8.140.

References (2)

Core 2
Core References

Scores

CVSS v3 7.8
EPSS 0.0016
EPSS Percentile 5.3%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-79
Status published
Products (1)
AWS/Kiro IDE 0.1 - 0.8.140
Published Apr 02, 2026
Tracked Since Apr 03, 2026