The file write tool in Amazon Kiro IDE versions before 1.0.242 enables remote unauthenticated actors to inject crafted instructions into the agent’s context. When a user runs the agent in a repository identified as untrusted, any message sent can cause the agent to modify auto‑loaded global configuration paths. This flaw permits an attacker to alter the IDE’s persistent settings, potentially redirecting behavior, leaking sensitive data, or disabling security controls. The weakness is tied to the weaknesses of insufficient authorization and improper access control, as reflected in CWE‑349 and CWE‑829.

Amazon Kiro IDE running on Linux, macOS, or Windows, prior to version 1.0.242, is affected. The vulnerability applies to any installation of the IDE before the documented patch release.

The vulnerability has a CVSS score of 8.6, indicating high severity. EPSS is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack path requires an unauthenticated remote actor to craft a repository and have a user run the agent in that untrusted workspace; the attacker then sends messages that trigger the configuration overwrite. Because the attack vector depends on user actions, the practical exploitability may vary, but the high CVSS score and lack of mitigation in earlier releases elevate the risk substantially.