Vulnerabilities CVE-2026-18657

CVE-2026-18657

High

Open

TLP:CLEAR

Executable Resolution from Untrusted Project Directory in Kiro CLI on Windows

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in the directory. To remediate this issue, users should upgrade to version 2.10.0 or higher.

Details

CVSS Score: 7.8
EPSS Score ⓘ: 0.16%

5.5th percentile
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Confidence: 90%
Published: Aug 4, 2026
Last Modified: Aug 5, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.