Kiro Ide EUVD-2026-18519

Kiro IDE versions before 0.8.140. Attacker crafts a malicious workspace with a specially-crafted color theme name. Local user must open the workspace and click 'trust' when prompted. Remote attacker delivers the workspace file to the victim.

Real-world risk assessment reveals moderate overall threat despite the 7.1 CVSS score and high impact ratings. The CVSS 4.0 vector shows this requires local access (AV:L), active user participation (UI:A), and specific preconditions (AT:P-user must trust the workspace). SSVC framework confirms exploitation status as 'none' with 'no' automatable capability, meaning attacks require social engineering to convince users to open and trust malicious workspace files-this cannot be weaponized into wormable or mass-exploitation campaigns. The 'total' technical impact rating (VC:H/VI:H/VA:H) reflects that successful exploitation grants full system compromise within the IDE's security context. No EPSS score is provided, but the combination of required user interaction, workspace trust prompt, and lack of public exploit code suggests low probability of widespread exploitation. This represents a supply chain risk vector where malicious actors could distribute trojanized Kiro IDE workspace files via Git repositories or shared project templates, similar to historical VSCode extension attacks. Priority should be elevated for organizations using Kiro IDE in collaborative development environments where workspace files are routinely shared, but remains lower than remotely exploitable vulnerabilities or those with confirmed active exploitation.

An attacker creates a malicious Kiro IDE workspace configuration with a specially crafted color theme name containing JavaScript payload, then distributes this workspace via a public GitHub repository advertising useful development tools or project templates. When a developer clones the repository and opens it in vulnerable Kiro IDE versions, the IDE prompts for workspace trust-a common occurrence developers often accept reflexively. Upon granting trust, the Kiro Agent webview renders the malicious theme name without sanitization, executing the embedded JavaScript with full IDE privileges, allowing the attacker to exfiltrate source code, inject backdoors into build pipelines, or establish persistence through IDE extension installation.