CVE-2026-9255 - Tool Execution Without Authorization via Piped Stdin in Kiro CLI
Cli ยท 2026-10-19
Actions
Technical Details
| Affected Versions | prior to 1.28.0 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-9255 |
| Migration Required | Yes |
| Cost Impact | Neutral |
What This Means
For DevOps Teams
Update Kiro CLI to version 1.28.0 to address CVE-2026-9255, which allows unauthorized tool execution, and consider using the --no-interactive flag when piping content from untrusted sources to enhance security.
For Platform Teams
Deploy the updated Kiro CLI version 1.28.0 across development environments to resolve the security vulnerability and maintain a secure coding assistant for developers.
For Executives
Implement the latest Kiro CLI version 1.28.0 to mitigate the security risk of unauthorized tool execution, ensuring user environments remain secure and compliant with best practices.
Source
Related Cli Updates
- CVE-2026-13769 โ Insecure file permissions in AWS CLI (2026-10-19)
- CVE-2026-9255 - Tool Execution Without Authorization via Piped Stdin in Kiro CLI (2026-10-14)
- CVE-2026-13769 โ Insecure file permissions in AWS CLI (2026-10-14)
- CVE-2026-13769 โ Insecure file permissions in AWS CLI (2026-10-09)
- AWS Client VPN now supports device posture assessment (2026-10-05)