CVE-2026-9255: Kiro CLI RCE Vulnerability

CVE-2026-9255 Overview

CVE-2026-9255 is a missing authorization vulnerability [CWE-862] in the Kiro CLI tool authorization prompt. Versions of kiro-cli before 1.28.0 fail to validate the source of input supplied to the tool approval prompt. A local attacker can pipe crafted content to kiro-cli via standard input (stdin) and cause the CLI to execute arbitrary tools, including shell commands, without explicit user approval. AWS published advisory 2026-035 covering the issue, and the Kiro CLI 1.28 changelog confirms the fix.

Critical Impact
Local attackers can execute arbitrary shell commands through Kiro CLI by piping malicious content to stdin, bypassing the tool authorization prompt entirely.

Affected Products

Kiro CLI (kiro-cli) versions prior to 1.28.0
Amazon Web Services (AWS) tooling distributing Kiro CLI
Developer workstations and CI/CD agents that invoke kiro-cli with piped input

Discovery Timeline

2026-05-22 - CVE-2026-9255 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-9255

Vulnerability Analysis

Kiro CLI presents an interactive authorization prompt before invoking tools, including shell command execution. The prompt expects approval from the interactive user. The CLI does not distinguish between input typed by a human on a controlling terminal and bytes streamed in through stdin from another process or file. When attacker-controlled content reaches stdin, the prompt consumes it as if the user had typed an approval response.

This design gap turns any data piped into kiro-cli into a potential consent channel. An attacker who can influence the content piped into the CLI, for example through a malicious file, a script invoked by the developer, or a crafted output from an upstream process in a pipeline, can approve arbitrary tool execution. The result is execution of shell commands in the context of the user running kiro-cli.

Root Cause

The root cause is missing input source validation in the tool authorization prompt. The prompt does not check whether stdin is attached to a TTY before accepting approval. Without that check, piped content is treated as user consent, satisfying the authorization gate that should require an interactive decision.

Attack Vector

Exploitation requires local access and user interaction in the form of running kiro-cli with attacker-influenced stdin. A typical scenario is a developer running a command such as cat untrusted.txt | kiro-cli or invoking kiro-cli from a script whose upstream input contains crafted approval sequences and tool invocation directives. The CLI then executes shell commands without the operator clicking through the prompt. No network access and no elevated privileges are required. See the AWS Security Bulletin 2026-035 and the Kiro.dev CLI Changelog 1.28 for vendor detail.

Detection Methods for CVE-2026-9255

Indicators of Compromise

Execution of kiro-cli processes with stdin redirected from a file or pipe rather than a TTY.
Child shell processes (sh, bash, zsh) spawned by kiro-cli without a corresponding interactive session.
Unexpected outbound network connections, file writes, or credential access initiated by kiro-cli child processes.

Detection Strategies

Inventory installed kiro-cli versions across developer endpoints and build agents and flag any version below 1.28.0.
Hunt process telemetry for kiro-cli invocations where the parent is a shell pipeline or a non-interactive script.
Correlate kiro-cli execution with subsequent command execution, file modification, or outbound connections to detect tool abuse.

Monitoring Recommendations

Enable command-line and parent-child process logging on workstations and CI runners that use Kiro CLI.
Alert on kiro-cli spawning shells or package managers shortly after reading from a non-TTY stdin.
Track software inventory changes to confirm upgrade to kiro-cli1.28.0 or later across the fleet.

How to Mitigate CVE-2026-9255

Immediate Actions Required

Upgrade kiro-cli to version 1.28.0 or later on every workstation, server, and CI/CD agent.
Audit existing scripts and pipelines that pipe data into kiro-cli and confirm none process untrusted content.
Revoke or rotate credentials accessible to users who ran vulnerable kiro-cli versions with untrusted input.

Patch Information

Kiro CLI 1.28.0 introduces input source validation in the tool authorization prompt, preventing piped stdin content from satisfying the approval gate. Refer to the Kiro.dev CLI Changelog 1.28 and AWS Security Bulletin 2026-035 for release details and verification guidance.

Workarounds

Do not pipe untrusted content into kiro-cli; always invoke the CLI from an interactive terminal until patched.
Remove kiro-cli from automated pipelines that consume external or user-supplied input as stdin.
Restrict execution of kiro-cli to trusted users on shared systems through filesystem permissions until the upgrade is complete.

bash

# Configuration example: verify and upgrade kiro-cli
kiro-cli --version
# Upgrade to the fixed release (use the installation method appropriate for your environment)
# After upgrade, confirm the version is 1.28.0 or later
kiro-cli --version