Executive brief
Kiro IDE is an AI-assisted development environment that helps developers build software. A vulnerability allows a malicious code repository to trick the Kiro agent into modifying the workspace settings to redirect requests to an attacker-controlled server, potentially exposing sensitive workspace information. Because the file is written before the user sees the approval prompt, an attacker can exfiltrate data by simply opening the Powers panel before the user responds to the confirmation dialog.
Technical details
CVE-2026-89332 is a configuration injection vulnerability in Kiro IDE where the agentic system can write to workspace settings files without proper preconditions or atomic operations. A specially crafted repository can exploit this by having the Kiro agent modify the workspace configuration to point the Powers registry URL to an attacker-controlled endpoint. The vulnerability exists because the settings file is written to disk before the user approval prompt is displayed; if a user opens the Powers panel before declining the modification, the request to the malicious URL is made anyway, transmitting potentially sensitive workspace data. Kiro did present the edit to the user for approval showing the inserted data and URL, but the race condition between file write and user confirmation allows exploitation. The vulnerability affects Kiro IDE versions prior to 0.8.135. No public exploits in the wild have been reported at the time of advisory publication.
Affected products
- AWS Kiro IDE < 0.8.135
Timeline
- 2026-09-11: disclosed
- 2026-09-11: advisory: AWS Security Bulletin 2026-111-AWS published