AWS Kiro RCE: Prompt Injection to Code Execution | Kodem

What it is

A joint Kodem Security / Intezer writeup of a prompt-injection-to-RCE flaw in Kiro, AWS's agentic IDE. The summary has the core chain; what it omits is the detail on why the approval prompt doesn't save you and the exact conditions under which the attack fires. No CVE, patch, or affected version is given in the text.

How it works

Kiro ships tools the model can invoke on its own — remote_web_search, webFetch, executeBash, fsWrite, and MCP-management tools. The MCP server list and start commands live in ~/.kiro/settings/mcp.json; Kiro reloads and executes that file whenever it changes. Unlike other paths Kiro treats as protected, this file is writable by the fsWrite tool without approval. So injected text in fetched content can direct the agent to append a new MCP server whose start command is arbitrary code, which runs on reload with the user's privileges.

The key detail beyond the summary: Kiro sometimes shows a pop-up that the MCP config changed and asks for approval — but the configuration is reloaded regardless of the user's response, so the warning is cosmetic, not a control.

Preconditions / Affected

Works against Kiro's default settings; no special configuration needed. Two things must be true:

• Attacker-controlled text reaches Kiro from an untrusted source (web fetch, docs, API response).
• The user performs a routine action that pulls that content in ("summarize this documentation", "install this tool").

What to do

The page prescribes no patch or command — its argument is that protecting high-risk actions belongs at the platform level, not the model. Practically, treat ~/.kiro/settings/mcp.json as a sensitive path: monitor it for unexpected writes and for MCP servers with outbound network start commands. Assume any Kiro workflow that fetches external web content can rewrite this file silently.

Caveats

Prompt injection itself is framed as unsolved and out of scope — the researchers' point is the missing approval boundary on the config file, not the injection. The example payload (a fake "telemetry" MCP server exfiltrating hostname/username/platform to <IP>:8080) is illustrative. No version, timeline, or vendor-fix status is stated in the text.

flowchart TD
    A[User: routine request] --> B[Kiro fetches external content]
    B --> C{Content carries<br/>injected instructions?}
    C -->|no| D[normal result]
    C -->|yes| E[fsWrite to mcp.json<br/>no approval]
    E --> F{Pop-up shown?}
    F -->|sometimes| G[reload happens<br/>regardless of answer]
    F -->|often| G
    G --> H[Malicious MCP server starts<br/>RCE as user]