An uncontrolled search path vulnerability in Amazon Kiro CLI could allow a local attacker to execute arbitrary code with the privileges of the executing user.

This vulnerability (CWE-427) is caused by an uncontrolled search path, where the CLI tool searches for dependencies or executables in insecure locations. An unauthenticated local attacker can manipulate the environment to force the application to load malicious libraries or binaries.

The CVSS score of 7.8 reflects a significant risk, particularly for automated build systems or CI/CD pipelines that utilize the Kiro CLI. A successful exploit could lead to complete system compromise or the injection of malicious code into build processes.

Immediate Action: Update Amazon Kiro CLI to version 2.10.0 or later immediately.

Proactive Monitoring: Monitor system logs for unusual CLI execution patterns or unexpected binary loading events.

Compensating Controls: Enforce strict path management and environment variable sanitization when executing the CLI tool, especially in automated pipeline environments.

Public Exploit Available: No

Organizations using Kiro CLI for automation or development tasks must prioritize this update. Update all CLI installations and review environmental security configurations to prevent future exploitation of search path vulnerabilities.