AWS Encryption CLI does not correctly implement strict mode
Summary
GHSA-2xwp-m7mq-7q3r: CLI does not correctly implement strict mode. Affects aws-encryption-sdk-cli across 2 version ranges.
< 1.8.0
>= 2.0.0, < 2.1.0
Fixed in 1.8.0 or 2.1.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AWS Encryption CLI is a command-line tool that enables users to encrypt and decrypt data using the AWS Key Management Service (KMS). It provides a simple interface for managing encryption keys and performing cryptographic operations. The CLI is available for Python and can be installed via PyPI. However, certain versions of the AWS Encryption CLI have a vulnerability related to the implementation of strict mode.
Vulnerability Detail
The vulnerability in the AWS Encryption CLI affects versions 0.0.0 to 1.7.0 and 2.0.0 to 2.0.9. When operating in strict mode, the CLI should only allow decryption using the user-defined set of customer master keys (CMKs). However, due to a flaw in the implementation, decryption can be successful using a CMK that is not included in the user-defined set. This means that an unauthorized user could potentially decrypt data using a CMK they do not have permission to access. The impact of this vulnerability depends on the specific use case and the sensitivity of the data being encrypted.
How To Fix
Latest published version: 4.3.0 as of 23 Oct 2026
pip install --upgrade "aws-encryption-sdk-cli==4.3.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.8.01.8.0pip install --upgrade "aws-encryption-sdk-cli==1.8.0" -
>= 2.0.0, < 2.1.02.1.0pip install --upgrade "aws-encryption-sdk-cli==2.1.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions as soon as possible.
Conclusion
The AWS Encryption CLI has a vulnerability that allows unauthorized decryption of data when operating in strict mode. Users should upgrade to the fixed versions (1.8.0 or higher for versions 0.0.0 to 1.7.0, and 2.1.0 or higher for versions 2.0.0 to 2.0.9) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aws-encryption-sdk-cli →
FAQ
The AWS Encryption CLI is a command-line tool for encrypting and decrypting data using the AWS Key Management Service (KMS). It provides an interface for managing encryption keys and performing cryptographic operations.
Strict mode is a feature in the AWS Encryption CLI that restricts decryption to a user-defined set of customer master keys (CMKs). It ensures that only authorized users can decrypt data.
An unauthorized user could exploit this vulnerability by decrypting data using a CMK they do not have permission to access. This could potentially lead to unauthorized access to sensitive information.
No, only versions 0.0.0 to 1.7.0 and 2.0.0 to 2.0.9 are affected. Users should upgrade to the fixed versions (1.8.0 or higher for versions 0.0.0 to 1.7.0, and 2.1.0 or higher for versions 2.0.0 to 2.0.9).
No, there is no known workaround. It is recommended to upgrade to the fixed versions as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for aws-encryption-sdk-cli.
