CVE-2026-9255

HighCVSS 7.8/10Last modified Jul 23, 2026

Description

Missing input source validation in the tool authorization prompt in Kiro CLI before 1.28.0 allows a local attacker to execute arbitrary tools, including shell commands, without user approval by crafting content that is piped to kiro-cli via stdin.

We recommend you to upgrade to kiro-cli version 1.28.0 or later.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: May 22, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-925507.5A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. CVE-2026-925516.1The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre CVE-2026-925538.8The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions u CVE-2026-925546.1The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripti CVE-2026-925559.8Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT CVE-2026-925599.8IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unre CVE-2026-92568.1NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists when a rewrite direct CVE-2026-925607.5A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. CVE-2026-925616.1The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to,CVE-2026-925647.5A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issu CVE-2026-925655.3Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee n CVE-2026-925668.2DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticate