Description

Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the workspace settings file, which redirects the Kiro Powers registry request to an actor controlled endpoint and sends workspace data to that endpoint when the Powers panel is opened. To remediate this issue, users should upgrade to Kiro IDE version 0.8.135 or later. Users who opened a project in an earlier version should also rotate any credentials that were present in that project.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-11T20:19:23.670Z",
  "pubdate": "2026-09-11T20:19:23.670Z",
  "executiveSummary": "A critical vulnerability exists in the Kiro Powers feature of the Amazon Kiro IDE, identified as an inclusion of functionality from an untrusted control sphere.\nThis flaw allows remote, unauthenticated actors to facilitate unauthorized data exfiltration from a developer's local workstation.\nThe vulnerability stems from the IDE's failure to validate the integrity of workspace settings, enabling an attacker to manipulate configuration files via malicious repository content.\nBy compromising the Kiro Powers registry request mechanism, an attacker can redirect the IDE to an actor-controlled endpoint, effectively exfiltrating sensitive workspace data, including potentially hardcoded credentials, API keys, or proprietary source code.\nThe risk profile is elevated due to the lack of required authentication for the exploit, as simply opening a maliciously crafted project is sufficient to trigger the malicious redirection.\nUsers are advised to immediately upgrade to version 0.8.135 or later to mitigate the exposure.\nPost-remediation, it is imperative to rotate any credentials or secrets that were present in workspaces opened with vulnerable IDE versions, as these must be considered compromised.",
  "technicalDetails": "The vulnerability is categorized as the inclusion of functionality from an untrusted control sphere within the Kiro Powers feature. The root cause lies in the IDE's permissive handling of workspace configuration files, specifically the workspace settings file, which is parsed and executed without adequate sanitization or boundary enforcement when a project is loaded.\nThe attack flow initiates when a victim clones or opens a malicious repository containing a crafted workspace settings file. When the Kiro Powers panel is invoked, the IDE reads this manipulated configuration file to determine the registry source for Kiro Powers functionality.\nAn attacker can modify the registry request URI within the settings file to point to a remote, actor-controlled server. Because the application logic fails to verify the provenance or trustworthiness of the registry location, it proceeds to initiate an outbound request to the attacker's infrastructure. This behavior occurs in the background upon the user interacting with the Powers panel, effectively masking the malicious activity from the user.\nUpon establishing a connection to the actor-controlled endpoint, the IDE automatically transmits sensitive workspace data to the attacker. This data exfiltration is facilitated by the IDE's internal processes, which may inadvertently expose environment variables, local file paths, or cached authentication tokens associated with the project environment.\nThe exploitation requirement is minimal: the victim must simply have a vulnerable version of Amazon Kiro IDE (prior to 0.8.135) and open a project containing the malicious configuration. No specific authentication is required from the attacker, nor are elevated privileges on the host system necessary to perform the redirection, as the IDE performs the actions within the context of the currently authenticated developer.\nThe impact of a successful exploit extends beyond the immediate session. Because workspace data—often including tokens, database connection strings, or cloud provider credentials—is transmitted to the adversary, the breach facilitates lateral movement and persistent unauthorized access to the developer's broader infrastructure. The post-exploitation risk is significant, as the compromised secrets provide the attacker with long-term access to the user's development environments, private repositories, and production systems if secrets are shared across environments."
}