CVE-2026-9255
Tool Execution Without Authorization via Piped Stdin in Kiro CLI
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 8.4EPSS 0.1%KEV nãoPoC —Patch referenciado
Ciclo de vida
22 may 2026Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
Missing input source validation in the tool authorization prompt in Kiro CLI before 1.28.0 allows a local attacker to execute arbitrary tools, including shell commands, without user approval by crafting content that is piped to kiro-cli via stdin.
We recommend you to upgrade to kiro-cli version 1.28.0 or later.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
AWS · Kiro CLI¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →