Kiro Cli · Kiro Cli · CVE-2026-18657
**Name of the Vulnerable Software and Affected Versions**
Kiro CLI versions prior to 2.10.0
**Description**
On Windows, an uncontrolled search path element allows a remote unauthenticated actor to execute arbitrary code. This occurs when a local user starts the application in a maliciously crafted project directory containing an executable, which bypasses workspace trust protections.
**Recommendations**
Upgrade to version 2.10.0 or higher.