AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code

A vulnerability in AWS Kiro, a coding IDE, allowed an attacker to rewrite its configuration file and execute code on a developer's machine. This could be achieved by visiting a web page with hidden text, which would trigger Kiro to rewrite its config and run the attacker's code without any approval step. The issue was discovered by Intezer and Kodem Security, who found that a simple request, such as summarizing a page, could lead to remote code execution. AWS has since patched the vulnerability, and it does not have a designated CVE. The flaw was significant as it could be exploited with minimal user interaction.