CVE-2026-5429
Unsanitized input during web page generation in the Kiro Agent webview in Kiro IDE before version 0.8.140 allows a remote unauthenticated threat actor to execute arbitrary code via a potentially damaging crafted color theme name when a local user opens the workspace. This issue requires the user to trust the workspace when prompted. To remediate this issue, users should upgrade to version 0.8.140.
- Published Apr 2, 2026
- CVSS 7.1 high
- 0.2% chance of exploitation in the next 30 days (EPSS)
- A fix is available
Affected software
In the news
- CVE-2026-5429 - Kiro IDE Webview Cross-Site Scripting via Workspace Color Theme AWS Security Bulletins ·