# CVE-2026-9255: Amazon Kiro CLI unauthorized command execution via piped stdin

Source: https://junglewise.ai/threats/cve-2026-9255-amazon-kiro-cli-unauthorized-command-execution-via-piped-stdin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-22. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-9255 · Severity: high · CVSS 7.8 · Published 2026-05-22

Kiro CLI is a command-line AI coding assistant used by developers to execute code and manage files. A security flaw in how the tool handles user confirmation prompts allows a local attacker to bypass security checks and execute unauthorized commands, such as shell scripts, by piping malicious data into the application. This could lead to full system compromise or unauthorized data access on the developer's machine.

Technologies: [Amazon AWS](https://junglewise.ai/threats/technologies/aws). Vendors: [Amazon](https://junglewise.ai/threats/vendors/amazon), [Amazon Web Services](https://junglewise.ai/threats/vendors/amazon-web-services).

## Quick answers

**Is CVE-2026-9255 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9255 being exploited in the wild.

**How severe is CVE-2026-9255?** High severity, with a CVSS score of 7.8, published 22 May 2026.

**Which products and versions are affected?** Amazon Web Services Kiro CLI < 1.28.0.

**Is there a fix for CVE-2026-9255?** A patch was published on 2026-03-20: Version 1.28.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9255 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-9255?** Check whether you run Amazon AWS or Amazon Web Services Kiro CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in Kiro CLI due to missing input source validation within the tool authorization prompt component. When the CLI prompts a user to authorize a tool execution (such as a shell command), it fails to distinguish between interactive keyboard input and data provided via standard input (stdin). A local attacker can exploit this by piping crafted content into the kiro-cli process, effectively 'pre-answering' the authorization prompt to bypass manual user approval. This allows for arbitrary command execution with the privileges of the user running the CLI. The issue is resolved in version 1.28.0; a temporary workaround is to use the --no-interactive flag when processing untrusted piped data.

## Affected products

- Amazon Kiro CLI versions before 1.28.0

## Timeline

- 2026-03-20: patched: Version 1.28.0 released
- 2026-05-22: disclosed: Initial advisory publication
- 2026-06-04: advisory: NVD analysis updated

## References

- [https://aws.amazon.com/security/security-bulletins/2026-035-aws/](https://aws.amazon.com/security/security-bulletins/2026-035-aws/)
- [https://kiro.dev/changelog/cli/1-28/](https://kiro.dev/changelog/cli/1-28/)

## Related threats

- [An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0)](https://junglewise.ai/threats/cve-2026-126793-privilege-escalation-in-aurora-postgresql-dialect-detection-in)
- [AWS SDK for pandas EMR unverified bucket ownership](https://junglewise.ai/threats/cve-2026-127119-unverified-ownership-of-the-default-emr-cluster-log-location-in)
- [Amazon mcp-gateway-registry server-side request forgery in registration API](https://junglewise.ai/threats/cve-2026-125926-server-side-request-forgery-in-the-server-registration-and)
- [Amazon mcp-gateway-registry authorization bypass in management API](https://junglewise.ai/threats/cve-2026-100307-missing-authorization-on-the-external-management-api-in-mcp)
- [AWS Kiro CLI incorrect default permissions on session files](https://junglewise.ai/threats/cve-2026-124848-incorrect-default-permissions-on-session-transcripts-and-prompt)