Kiro Crew
Monthly
Kiro Crew before version 0.7.2 contains a missing authorization flaw in its WhatsApp group channel integration that lets a remote attacker who is a member of an operator-configured WhatsApp group control the operator's other agent sessions and execute arbitrary commands on the host. The attacker must already belong to the specific group (low privileges, PR:L), but no operator interaction is required; deployments that do not enable the WhatsApp channel are not exposed. The vendor has released version 0.7.2 to fix the issue, and no public exploit code has been identified at the time of analysis.
Kiro Crew before version 0.7.2 contains a missing authorization flaw in its WhatsApp group channel integration that lets a remote attacker who is a member of an operator-configured WhatsApp group control the operator's other agent sessions and execute arbitrary commands on the host. The attacker must already belong to the specific group (low privileges, PR:L), but no operator interaction is required; deployments that do not enable the WhatsApp channel are not exposed. The vendor has released version 0.7.2 to fix the issue, and no public exploit code has been identified at the time of analysis.