Key points
- AWS released version 0.8.140 to fix CVE-2026-5429 in Kiro IDE.
- The flaw allows remote attackers to run code via malicious color themes.
- Exploitation requires a user to open a workspace and trust it.
AWS has released version 0.8.140 of Kiro IDE to address a security vulnerability identified as CVE-2026-5429. The advisory, published on April 2, 2026, classifies the issue as important and requiring attention. The fix is available immediately for users of the agentic development environment. Teams using earlier versions should plan to upgrade to this specific release to eliminate the risk of arbitrary code execution within the application’s webview component.
In plain English
The vulnerability exists in how Kiro IDE handles color theme names when generating web pages for the Kiro Agent webview. Input data is not properly sanitized during this process. A remote attacker who does not need authentication can craft a malicious color theme name. If a local user opens a workspace containing this theme and chooses to trust it when prompted, the attacker can execute arbitrary code on the system.
The background
Kiro IDE is designed as an agentic development environment that helps developers complete engineering tasks with AI assistance. The security bulletin notes that the issue affects versions prior to 0.8.140. AWS Security Bulletins identified the flaw through a coordinated disclosure process. The company thanked researcher Dhiraj Mishra for collaborating on the discovery and resolution of these issues. The CVE record is available via the official CVE database for further technical reference.
What changes now
Users must upgrade to Kiro IDE version 0.8.140 to resolve the cross-site scripting flaw. The advisory explicitly recommends ensuring that any forked or derivative code is also patched to incorporate these new fixes. This update closes the vector that allowed unsanitized input to lead to code execution. Organizations managing multiple instances of the IDE should verify that all installations meet this version threshold to maintain a secure development environment.
Who needs to act first
Teams should prioritize updating systems that are exposed to untrusted workspaces or shared repositories. Identify environments where developers regularly open external projects without strict validation. Roll out the update to a small group of non-production machines first to verify compatibility with existing configurations. Back up current workspace settings before applying the patch. If immediate updates are not possible, restrict access to the IDE for users who might encounter unverified themes. Monitor logs for unusual activity in webview components.
What to do and how to stay safe: AWS
- Check current Kiro IDE versions across your organization and identify any installations below 0.8.140.
- Upgrade all affected instances to version 0.8.140 or the latest available release.
- Review forked or customized codebases to ensure they include the security patches from the official release.
- Educate developers about the risks of trusting unknown workspaces and encourage caution when opening external projects.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-5429?
It is a cross-site scripting vulnerability in Kiro IDE that allows remote code execution via malicious color theme names.
Which versions of Kiro IDE are affected?
All versions of Kiro IDE prior to 0.8.140 are affected by this vulnerability.
Is there a fix available for this issue?
Yes, AWS has released version 0.8.140 which addresses the vulnerability.
