Kiro IDE CVE-2026-89332

Three conditions must all be satisfied: (1) The developer opens a crafted malicious repository in Kiro IDE prior to version 0.8.135 - the malicious content instructs the Kiro agent to modify workspace settings. (2) The Kiro Powers feature must be accessible, which is the default for Kiro IDE installations. (3) After the settings are silently overwritten by the agent, the developer must open the Powers panel, which triggers the outbound call to the attacker-controlled registry endpoint and transmits workspace data. The attacker requires no authentication or prior access to the developer's system. Exploitation is limited by the need for two distinct developer interactions and by the attacker's ability to get a developer to open their repository; it is not exploitable against arbitrary Kiro IDE users who do not open the attacker's project.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.5) is inconsistent with the described impact: the description clearly establishes credential and workspace data exfiltration (a Confidentiality impact) and workspace settings file modification (an Integrity impact), not an Availability impact - the A:H/C:N/I:N combination appears to be erroneous and should be verified against the AWS advisory. Real-world risk is materially higher than a 5.5 score implies. Developer workstations are high-value targets, routinely holding live AWS API keys, database connection strings, and other cloud credentials - especially pertinent given the AWS/Kiro ecosystem overlap. Even a mid-sized municipal IT team in gdynia that has adopted Kiro IDE should treat this as urgent if cloud credentials exist anywhere in project workspaces. Two user interactions are required (opening the project and opening the Powers panel), which limits automated mass exploitation. However, developers routinely clone repositories from public or semi-trusted sources, making the social-engineering barrier low. The AWS advisory's explicit recommendation to rotate credentials confirms the vendor expects live secrets may have been captured. No active exploitation confirmed (not in CISA KEV) and no public POC referenced.

An attacker publishes a public repository containing crafted content designed to instruct the Kiro AI agent to modify the workspace settings file, replacing the legitimate Kiro Powers registry URL with the attacker's server. A developer clones and opens the repository in a vulnerable Kiro IDE version; once the developer opens the Powers panel, the IDE contacts the attacker's endpoint and transmits workspace data including any secrets or credentials in scope. No POC code is publicly referenced, but the attack chain is conceptually straightforward given the description.