Loading story…
Researchers disclosed multiple prompt injection flaws in AWS's Kiro IDE that allowed untrusted content to rewrite the tool's own configuration and execute arbitrary code on a developer's machine. One attack showed that prompt injection hidden in source code comments could modify trusted settings such as .vscode/settings.json or add malicious Model Context Protocol servers through ~/.kiro/settings/mcp.json, effectively allowlisting dangerous Bash commands and triggering local program execution without meaningful user consent.
A later finding showed a poisoned web page could similarly induce Kiro to overwrite its MCP configuration, automatically reload it, and launch attacker-defined MCP servers with the developer's privileges. AWS patched the issues in subsequent Kiro releases, including fixes reported in v0.1.42 and confirmation that the web-based attack no longer worked in v0.11.130, while adding protected-path enforcement and a capability-based permissions model; no CVE was assigned to the reported flaws.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
AWS patched the Kiro flaw that allowed poisoned web content to rewrite MCP configuration and trigger arbitrary code execution, and Intezer confirmed the attack no longer worked in Kiro v0.11.130. No CVE was assigned for this specific finding.
Intezer, working with Kodem Security, found that hidden prompt injection content on a web page could cause AWS Kiro IDE to rewrite ~/.kiro/settings/mcp.json and execute arbitrary code through attacker-defined MCP servers. The finding highlighted Kiro's automatic reload of the file and server launch with the developer's privileges.
AWS reportedly fixed the Kiro issues by releasing version 0.1.42, addressing the ability to alter configuration files and enable malicious command execution paths. No CVE was issued for the vulnerability.
A security researcher notified AWS that Kiro could be abused for arbitrary command execution via indirect prompt injection, including by modifying trusted configuration files such as .vscode/settings.json or .kiro/settings/mcp.json.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourceresearch.intezer.com
Open sourceembracethered.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amazon patched a high-severity flaw in **Amazon Q Developer** and the underlying **Language Servers for AWS** that allowed a booby-trapped repository to execute attacker-controlled commands when a developer opened and trusted a workspace. Tracked as **`CVE-2026-12957`** and rated **CVSS 8.5**, the issue involved unsafe handling of **Model Context Protocol (MCP)** configuration files such as **`.amazonq/mcp.json`**, which could cause Amazon Q integrations for **VS Code, JetBrains, Eclipse, and Visual Studio** to launch local processes defined by an attacker. Those processes inherited the developer’s environment, exposing **AWS credentials, API keys, authentication tokens, and SSH agent access** already present on the machine. **Wiz Research** reported the vulnerability to AWS on April 20, and AWS fixed it on May 12, later publishing an advisory and releasing remediation in **Language Servers for AWS 1.65.0**. AWS also addressed a related flaw, **`CVE-2026-12958`**, involving missing symlink validation that could enable arbitrary file writes outside the workspace trust boundary; customers were advised to upgrade to **version 1.69.0** to cover both issues. Researchers said likely attack paths include fake coding tests, typosquatted open-source packages, and malicious pull requests, while noting the weakness reflects broader trust-boundary problems emerging across AI coding assistants that adopt MCP-style workspace configuration.
Jun 29, 2026
Researchers disclosed multiple security flaws affecting AWS MCP components, including a local file inclusion bug in the AWS Remote MCP Server and a critical command injection issue in `aws-mcp-server`. Varonis said authenticated users could abuse AWS CLI shorthand syntax, specifically the `@=` operator passed through the `aws___call_aws` tool, to read arbitrary files from the underlying host even when `FileAccessMode=NO_ACCESS` was enabled. AWS assigned **CVE-2026-4270** to the file access restriction bypass and said the issue was fixed in `aws-api-mcp-server` version **1.3.9**; the exposure affected the public endpoint `aws-mcp.us-east-1.api.aws` as well as self-hosted or forked deployments. A separate flaw, tracked as **CVE-2026-5058** and published by Trend Micro's Zero Day Initiative as **ZDI-26-246**, allows unauthenticated remote code execution in `aws-mcp-server` because user-supplied input in the allowed-commands list is not properly validated before being used in a system call. ZDI rated the bug **CVSS 9.8** and said successful exploitation lets attackers run arbitrary code in the MCP server context; the advisory was released as a 0-day after the vendor rejected the report. The disclosures landed alongside another AWS bulletin for **CVE-2026-4269**, an improper S3 ownership verification issue in the Bedrock AgentCore Starter Toolkit, underscoring broader security concerns around MCP-related tooling and the need for immediate patching and review of derivative implementations.
Jun 29, 2026
Microsoft disclosed and coordinated fixes for command injection vulnerabilities affecting **Visual Studio Code** and the **Azure `azure-cli-mcp` component**, with both flaws allowing arbitrary code execution through improper validation of user-supplied input before it is passed to a system call. In Visual Studio Code, tracked as **`CVE-2026-21518`** and **`ZDI-26-253`**, a remote attacker can achieve code execution in the context of the current user if a victim opens a malicious project containing a crafted `mcp.json` file; the issue was assigned a **CVSS 7.8** rating and patched by Microsoft.
Jun 29, 2026