Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-124848

Incorrect default permissions on session transcripts and prompt history in Kiro CLI

Incorrect default file permissions in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Linux might allow other local users on the same host to read a user's session transcripts and prompt history, including any credentials or source code they contain. The CLI created its local session storage files with permissions that made them readable by all local users. To remediate this issue, users should upgrade to Kiro CLI version 2.27.0 or later and launch it once. Users who ran Amazon Q Developer CLI 1.16.0 through 1.19.x should also delete the ~/.aws/amazonq/.cli_bash_history file or restrict it to the owner.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Amazon
Products
Kiro Cli
CVE-2026-18657

Executable Resolution from Untrusted Project Directory in Kiro CLI on Windows

An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in the directory. To remediate this issue, users should upgrade to version 2.10.0 or higher.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Amazon Microsoft
Products
Kiro Cli Windows
CVE-2026-9255

Tool Execution Without Authorization via Piped Stdin in Kiro CLI

Missing input source validation in the tool authorization prompt in Kiro CLI before 1.28.0 allows a local attacker to execute arbitrary tools, including shell commands, without user approval by crafting content that is piped to kiro-cli via stdin. We recommend you to upgrade to kiro-cli version 1.28.0 or later.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Amazon Aws
Products
Kiro Cli Kiro Cli