Incorrect Default Permissions Affecting awscli package, versions [1.13.0,1.44.37)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Incorrect Default Permissions vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-PYTHON-AWSCLI-15363381
- published27 Feb 2026
- disclosed27 Feb 2026
- creditUnknown
Introduced: 27 Feb 2026
CVE NOT AVAILABLE CWE-276 (opens in a new tab)How to fix?
Upgrade awscli to version 1.44.37 or higher.
Overview
Affected versions of this package are vulnerable to Incorrect Default Permissions in the cli_history feature. An attacker can access sensitive command history and API request/response data by reading the history database file if it is created with default permissions on a multi-user Unix system.
Note:
This is only exploitable if cli_history is explicitly enabled in the configuration.
The fix is implemented for AWS CLI version 2 in 2.33.20 which is available to install only as a bundled installer. About AWS CLI version.
PoC
AWS CLI is a command line tool for interacting with AWS services. When the cli_history feature is enabled, the history database file is created with default permissions, potentially allowing other local users on a multi-user system to read the file.
Impact When cli_history is enabled, AWS CLI stores command history including command parameters and API request/response data in a local SQLite database. On multi-user Unix systems, the default file permissions may allow other local users to read this file, potentially exposing sensitive information. This issue only affects users who have explicitly enabled cli_history, which is disabled by default.