CVE-2026-18657
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in the directory. To remediate this issue, users should upgrade to version 2.10.0 or higher.
Risk Assessment
An attacker can execute arbitrary code on the user's machine, potentially leading to system compromise and data theft.
Recommendation
Upgrade Kiro CLI to version 2.10.0 or later, which includes the fix. Avoid running Kiro CLI in untrusted directories.
Other vulnerabilities in Kiro CLI
Original NVD description (English source)
An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in the directory. To remediate this issue, users should upgrade to version 2.10.0 or higher.