Executive brief
Kiro CLI is a command-line AI coding assistant used by developers to execute code and manage files. A security flaw in how the tool handles user confirmation prompts allows a local attacker to bypass security checks and execute unauthorized commands, such as shell scripts, by piping malicious data into the application. This could lead to full system compromise or unauthorized data access on the developer's machine.
Technical details
A vulnerability exists in Kiro CLI due to missing input source validation within the tool authorization prompt component. When the CLI prompts a user to authorize a tool execution (such as a shell command), it fails to distinguish between interactive keyboard input and data provided via standard input (stdin). A local attacker can exploit this by piping crafted content into the kiro-cli process, effectively 'pre-answering' the authorization prompt to bypass manual user approval. This allows for arbitrary command execution with the privileges of the user running the CLI. The issue is resolved in version 1.28.0; a temporary workaround is to use the --no-interactive flag when processing untrusted piped data.
Affected products
- Amazon Kiro CLI versions before 1.28.0
Timeline
- 2026-03-20: patched: Version 1.28.0 released
- 2026-05-22: disclosed: Initial advisory publication
- 2026-06-04: advisory: NVD analysis updated