AWS Kiro Flaw: Hidden Web Page Text Could Trigger Remote Code Execution

A critical vulnerability in AWS Kiro, an agentic coding IDE, allowed a poisoned web page to rewrite its configuration file and execute arbitrary code on a developer’s machine. Discovered by Intezer in collaboration with Kodem Security, the flaw exploited Kiro’s ability to fetch and process web content. By embedding hidden instructions in one-pixel white text on an API documentation page, an attacker could trick Kiro into modifying its Model Context Protocol (MCP) configuration file (~/.kiro/settings/mcp.json) without user approval. This enabled the execution of arbitrary commands with the developer’s privileges, potentially leading to credential theft, source code exfiltration, or lateral movement within internal networks.

The vulnerability was present in Kiro versions 0.9.2 (macOS) and 0.10.16 (Ubuntu) and was patched in version 0.11.130. AWS addressed the issue by marking sensitive files as protected paths, requiring explicit approval for writes. The fix applies to both Autopilot and Supervised modes. No CVE was assigned, and no in-the-wild exploitation was reported. This marks the third instance of a similar bug in Kiro, following earlier findings by Johann Rehberger and Cymulate (CVE-2026-10591). The incident underscores the need for platform-level security controls in AI coding tools, as human-in-the-loop approvals can be bypassed by prompt injection attacks.