localstack vulnerabilities

Products

• localstack 3
• serverless-localstack 1

Latest localstack CVEs

Newest publication first

1. CVE-2026-16763 localstack serverless-localstack Configuration index.js os command injection

   Published 2026-07-23

   Medium·CVSS 4.8 EPSS 1.2%

   A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.compose_file leads to os command...

2. CVE-2023-48054 Missing SSL certificate validation in localstack

   Published 2023-11-16

   High·CVSS 7.4 EPSS 0.30%

   Missing SSL certificate validation in localstack v2.3.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.

3. CVE-2021-32090 Command injection in LocalStack

   Published 2021-05-07

   Critical·CVSS 9.8 EPSS 2.1%

   The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter.

4. CVE-2021-32091 Cross-site scripting in LocalStack

   Published 2021-05-07

   Medium·CVSS 6.1 EPSS 0.85%

   A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.