Amazon Kiro IDE EUVD-2026-86308

Requires the victim to open an attacker-crafted repository specifically as an 'untrusted workspace' in Amazon Kiro IDE (version before 1.0.242) and then send any message to the agent, which causes the agent's file-write tool to write attacker-controlled content into the auto-loaded global configuration directory (~/.kiro). Limiting factors: user interaction is mandatory (UI:A in the vendor vector) - the attacker cannot trigger the write without a victim actively running the agent against the malicious workspace; exploitation is indirect via prompt injection rather than a direct network request; and versions 1.0.242 and later are fixed. The 'untrusted workspace' mode plus agent invocation is the concrete precondition, not a generic default-remote exposure.

The vendor CVSS 4.0 score of 8.6 (High) reflects network-reachable, low-complexity delivery with no attacker authentication (AV:N/AC:L/PR:N) but explicitly requires active user interaction (UI:A) and impacts only the vulnerable system (VC:H/VI:H/VA:H, SC/SI/SA:N). The real-world trigger chain is narrower than the raw score suggests: exploitation is an indirect prompt-injection (CWE-829) that only fires when a user opens a crafted repository as an *untrusted workspace* and then sends any message to the agent - so the attacker cannot act autonomously and depends on victim behavior, which in practice makes attack complexity higher than the AC:L in the 4.0 vector implies. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis' - this is a proactively patched, vendor-reported (AMZN) issue rather than an observed in-the-wild campaign. Signals are internally consistent (network vector, user-interaction-gated, patch available) with no direct contradictions, though the 4.0 AC:L combined with UI:A slightly overstates ease given the specific 'untrusted workspace + send a message' precondition. Net: a genuine and worth-prioritizing issue for organizations that use Kiro against third-party/untrusted code, but not a mass-exploitation emergency given the narrow deployment footprint and interaction requirement.

An attacker publishes a repository containing hidden instructions embedded in files that the agent ingests into its context. A developer clones it, opens it in Kiro as an untrusted workspace, and sends any message to the agent; the injected instructions cause the file-write tool to modify the auto-loaded global configuration under ~/.kiro, persistently poisoning the agent's behavior across future sessions. No public exploit code has been identified, and the attack requires the victim to actively run the agent in the malicious workspace.