Which versions of Kiro CLI are affected by CVE-2026-18657?

Amazon Kiro CLI on Windows (versions before 2.10.0) contains a critical arbitrary code execution vulnerability (CVE-2026-18657, CVSS 8.5) exploitable through social engineering when users open…. A patch is available.

How to fix or mitigate CVE-2026-18657?

Within 24 hours, inventory all Windows systems running Kiro CLI and alert users to the social engineering risk. By day 7, deploy Kiro CLI version 2.10.0 or later organization-wide using your standard deployment process, prioritizing development teams. Within 30 days, audit third-party project handling practices and conduct security awareness training on untrusted files.

Kiro CLI CVE-2026-18657

Q: What is the CVSS score of CVE-2026-18657?

CVE-2026-18657 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-52914 HIGH

Uncontrolled Search Path Element (CWE-427)

2026-08-04 AMZN

GHSA-vr58-qjgp-x52v

RCE Microsoft Amazon Kiro Cli

8.5

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

8.5 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local vector because attacker plants a file in a directory the victim opens; UI:R because user must launch CLI; PR:N because no system privilege is needed from attacker.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 20:37 vuln.today

CVSS changed

Aug 04, 2026 - 20:22 NVD

7.8 (HIGH) 8.5 (HIGH)

CVE Published

Aug 04, 2026 - 19:38 cve.org

HIGH 8.5

DescriptionCVE.org

An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in the directory.

To remediate this issue, users should upgrade to version 2.10.0 or higher.

AnalysisAI

Uncontrolled search path execution in Amazon Kiro CLI on Windows allows arbitrary code execution when a local user opens the CLI within a maliciously crafted project directory. Affected versions are all Kiro CLI releases before 2.10.0 on Windows; the flaw bypasses workspace trust protections by placing a malicious executable in a directory that Kiro CLI resolves via an uncontrolled search path. No public exploit code has been identified at time of analysis, though exploitation requires only user interaction - not attacker presence on the system - making social engineering a viable delivery mechanism.

Technical ContextAI

CWE-427 (Uncontrolled Search Path Element) describes a class of vulnerabilities where an application resolves executable or library names against an attacker-influenced search path. In this case, Kiro CLI - Amazon's AI-assisted coding CLI tool (CPE: cpe:2.3:a:amazon:kiro_cli:*:*:*:*:*:*:*:*) - appears to search the current working directory or a user-controlled PATH location for executables during startup on Windows. Windows historically prioritizes the current working directory in DLL and executable resolution, making it a well-known attack surface for search-path abuse. The workspace trust protection mechanism, intended to sandbox untrusted project directories, is circumvented, allowing a crafted project directory to deliver and execute a malicious binary when Kiro CLI is launched within it.

RemediationAI

Upgrade Kiro CLI to version 2.10.0 or later, which resolves the uncontrolled search path issue per the vendor advisory at https://aws.amazon.com/security/security-bulletins/2026-074-aws/ and changelog at https://kiro.dev/changelog/cli/2-10/. As a compensating control prior to patching, users should avoid running Kiro CLI in directories obtained from untrusted sources such as cloned repositories from unknown parties or downloaded project archives - this limits the attacker's ability to place a malicious executable in the working directory. Additionally, Windows environments can restrict the current-working-directory search path behavior through Group Policy or by setting the CWDIllegalInDllSearch registry key, though this may affect other application behavior and should be tested. The primary fix is the version upgrade; compensating controls carry trade-offs and should not substitute for patching.