Kiro IDE Webview Unsanitized Input Vulnerability Allowing Arbitrary Code Execution
Vulnerability
A vulnerability in Kiro IDE's webview component of the Kiro Agent, prior to version 0.8.140, allows remote, unauthenticated execution of arbitrary code. This issue arises from unsanitized input during web page generation, where a crafted color theme name can be used to execute malicious code when a local user opens the workspace. The vulnerability requires the user to trust the workspace when prompted.
Impact
Exploitation of this vulnerability allows for arbitrary code execution on the affected system.
Remediation
Users are advised to upgrade to Kiro IDE version 0.8.140 or later. Instructions for updating can be found in the Kiro IDE Changelog.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.