CVE-2026-18657: Kiro CLI RCE Vulnerability on Windows

CVE-2026-18657 Overview

CVE-2026-18657 is an uncontrolled search path element vulnerability [CWE-427] in Kiro CLI versions prior to 2.10.0 on Windows. A remote unauthenticated actor can achieve arbitrary code execution by placing a maliciously crafted executable inside a project directory. When a local user launches Kiro CLI from that directory, the malicious binary loads and bypasses workspace trust protections. The issue affects Windows installations of Kiro CLI and is resolved in version 2.10.0. AWS published the fix in AWS Security Bulletin 2026-074 and the Kiro CLI Changelog 2.10.

Critical Impact
Attackers can achieve arbitrary code execution on Windows hosts when a user starts Kiro CLI inside an attacker-controlled project directory, bypassing workspace trust.

Affected Products

Kiro CLI versions prior to 2.10.0 on Windows
Kiro CLI installations that launch from user-writable project directories
Windows environments where users clone or open untrusted repositories with Kiro CLI

Discovery Timeline

2026-08-04 - CVE-2026-18657 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-18657

Vulnerability Analysis

The flaw is an uncontrolled search path element weakness in Kiro CLI on Windows. When a user runs the CLI inside a project directory, the process resolves one or more executable dependencies using a search path that includes the current working directory. An attacker who controls the contents of that directory can place a binary with a name Kiro CLI expects to invoke. Windows resolves the attacker's binary before trusted system locations, and the CLI executes it in the user's security context. Workspace trust protections that normally gate execution of untrusted project content do not intercept this loader-level lookup.

Root Cause

The root cause is improper control of the executable search path, tracked as [CWE-427]. Kiro CLI relies on default Windows path resolution behavior, which searches the current directory ahead of secured system paths for referenced executables. Because project directories are user-writable and often sourced from untrusted repositories, this ordering allows planted binaries to be selected instead of legitimate ones.

Attack Vector

Exploitation requires an attacker to prepare a project directory containing a hostile executable named to match a binary Kiro CLI invokes during startup or normal operation. The directory is delivered through a repository clone, archive extraction, or shared network location. When the local user starts Kiro CLI inside that directory, the malicious executable runs with the user's privileges. The attack requires user interaction (UI:P) to launch the CLI, but no authentication is needed. Payload execution bypasses workspace trust, so users who explicitly declined to trust the workspace can still be compromised. Refer to the AWS Security Bulletin 2026-074 for vendor-provided technical detail.

Detection Methods for CVE-2026-18657

Indicators of Compromise

Unexpected executables (.exe, .dll, .bat, .cmd) present in project or repository root directories that match names of common Windows utilities or Kiro CLI dependencies
Kiro CLI process spawning child processes from paths inside user-writable project directories rather than from Program Files or system directories
Outbound network connections initiated shortly after Kiro CLI startup from directories tied to recently cloned repositories

Detection Strategies

Hunt for process creation events where the parent is Kiro CLI and the child image path resides under a user profile, repository, or temporary directory
Correlate repository clone or archive extraction events with subsequent Kiro CLI executions from the same path
Alert on writes of executable file types into directories that also contain project manifests such as .git, package.json, or kiro.json

Monitoring Recommendations

Enable Windows process command-line and image-load auditing on developer endpoints running Kiro CLI
Baseline the legitimate binaries invoked by Kiro CLI 2.10.0 and flag deviations sourced from non-standard paths
Monitor code repositories and shared file stores for newly added executables at directory roots

How to Mitigate CVE-2026-18657

Immediate Actions Required

Upgrade Kiro CLI to version 2.10.0 or later on all Windows hosts, as directed in the Kiro CLI Changelog 2.10
Inventory developer workstations to identify any Kiro CLI installations below 2.10.0 and prioritize patching
Audit recently cloned or extracted project directories for unexpected executables placed at the directory root

Patch Information

Upgrade to Kiro CLI 2.10.0 or higher. The fix is documented in AWS Security Bulletin 2026-074 and the Kiro CLI Changelog 2.10.

Workarounds

Do not launch Kiro CLI from untrusted project directories until the CLI is upgraded to 2.10.0 or later
Clone repositories into a controlled parent directory and inspect for executables at the root before running the CLI
Enforce application allow-listing on developer endpoints so unsigned executables from user-writable paths cannot execute

bash

# Verify installed Kiro CLI version on Windows
kiro --version

# Example remediation: upgrade via the vendor installer or package manager,
# then confirm the reported version is 2.10.0 or higher
kiro --version | findstr /R "2\.1[0-9]\."