{
  "entry": {
    "kind": "vuln",
    "slug": "kiro-powers-a-steering-file-renders-your-local-files-into-a-markdown",
    "name": "kiro-powers-a-steering-file-renders-your-local-files-into-a-markdown",
    "vendor": "Kiro IDE",
    "description": "Mindgard showed that attacker-controlled repository content can steer the AWS Kiro agent into exfiltrating local data with no code execution involved. A Kiro Power bundles MCP server configuration, hooks, contextual knowledge and a POWER.md steering file that acts as a persistent onboarding manual telling the agent which tools exist and when to use them. A crafted steering file directs the agent to read a local file and embed its contents in a Markdown image reference, and rendering that image performs the request that carries the data to an attacker server. Exploitation needs two ordinary user actions, opening a malicious project through a workspace file and sending the agent any message at all, which Mindgard assessed as low difficulty. The finding was confirmed against Kiro IDE 0.7.45 on Windows; Amazon fixed it in 0.8.140 and assigned no CVE, and by the 27 August 2026 public write-up the current release was 1.0.337.",
    "website": "https://thehackernews.com/2026/08/amazon-kiro-prompt-injection-can.html",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "skill",
    "updatedAt": "2026-08-27",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "kiro-powers-a-steering-file-renders-your-local-files-into-a-markdown",
      "aliases": [
        "ti-089"
      ],
      "title": "Kiro Powers: A Steering File Renders Your Local Files Into a Markdown Image and Ships Them Out",
      "summary": "Mindgard showed that attacker-controlled repository content can steer the AWS Kiro agent into exfiltrating local data with no code execution involved. A Kiro Power bundles MCP server configuration, hooks, contextual knowledge and a POWER.md steering file that acts as a persistent onboarding manual telling the agent which tools exist and when to use them. A crafted steering file directs the agent to read a local file and embed its contents in a Markdown image reference, and rendering that image performs the request that carries the data to an attacker server. Exploitation needs two ordinary user actions, opening a malicious project through a workspace file and sending the agent any message at all, which Mindgard assessed as low difficulty. The finding was confirmed against Kiro IDE 0.7.45 on Windows; Amazon fixed it in 0.8.140 and assigned no CVE, and by the 27 August 2026 public write-up the current release was 1.0.337.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Prompt injection",
        "Data exfiltration"
      ],
      "componentType": "skill",
      "component": {
        "name": "Kiro IDE",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": "agent/kiro"
      },
      "affected": [
        {
          "range": "Kiro IDE < 0.8.140 (confirmed on 0.7.45, Windows). Fixed in 0.8.140; no CVE assigned.",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-08-27",
      "modifiedAt": "2026-08-27",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://thehackernews.com/2026/08/amazon-kiro-prompt-injection-can.html"
        }
      ],
      "mitigation": "The version fix is long since shipped, so the exposure now is any machine left behind on a pre-0.8.140 Kiro, which no CVE will flag for you because none was assigned. The durable lesson is the shape: a steering file is executable policy for the agent, not documentation, and it arrives with the repository. Inventory which Powers are installed and where they came from, treat POWER.md and equivalent steering files as reviewable config rather than prose, and note that Markdown image rendering is an outbound request, which makes it an exfiltration channel in any agent surface that renders replies.",
      "detectedByAnomity": true
    }
  }
}