AWS Kiro Prompt Injection CVE: How a Webpage Read Became Code Execution

AWS patched a CVSS 8.8 flaw in Kiro IDE where hidden instructions in any webpage could rewrite Kiro's MCP config and execute attacker code — no user click required.

Researchers at Cymulate found that Kiro's agent would follow injected instructions embedded as invisible text (e.g. color: white; font-size: 0) on any page it was asked to read or summarize. The attack chain:

1. Attacker plants hidden text on a webpage
2. Developer asks Kiro to summarize that page
3. Hidden instructions tell Kiro to overwrite ~/.kiro/settings/mcp.json
4. Kiro reloads its MCP config and auto-starts the attacker-controlled MCP server
5. Attacker code runs with developer privileges; no approval prompt fires

AWS assigned CVE-2026-10591 (CVSS 8.8 High) and fixed it in Kiro 0.11 by requiring explicit user approval before writing to execution-sensitive paths such as mcp.json and .vscode/tasks.json.

This pattern is not unique to Kiro. Researchers catalogued 30+ similar prompt-injection-to-code-execution chains across AI coding tools in late 2025 — Cursor and Copilot included. The MCP config file is an especially attractive target: compromise it and any tool with any argument is callable without further approval.

Why it matters: Any AI IDE that reads external content and has write access to its own config is a potential prompt-injection path to RCE. Update Kiro past 0.11 immediately; and audit which files your AI coding tools can modify silently.

Sources: CVE-2026-10591 — AWS Security Bulletin 2026-037 · AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config (The Hacker News) · AWS Kiro RCE: Prompt Injection to Code Execution (Kodem Security)