pypi localstack vulnerabilities

Latest pypi localstack CVEs

Newest publication first

1. CVE-2023-48054 Missing SSL certificate validation in localstack

   Published 2023-11-16

   High·CVSS 7.4 EPSS 0.30%

   Missing SSL certificate validation in localstack v2.3.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.

2. CVE-2021-32090 Command injection in LocalStack

   Published 2021-05-07

   Critical·CVSS 9.8 EPSS 2.1%

   The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter.

3. CVE-2021-32091 Cross-site scripting in LocalStack

   Published 2021-05-07

   Medium·CVSS 6.1 EPSS 0.85%

   A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.