CVE-2026-9255 — Missing input source validation in the tool authorization prompt in Kiro CLI before 1.28.0 allows a local attacker to execute arbitrary tools, including shell commands, without user approval by crafti — CVE Database · The Intelligence Room