LocalStack CVE-2025-65200

Requires the LocalStack CloudFormation deploy UI endpoint (/_localstack/cloudformation/deploy) to be network-reachable and a user to open a deploy URL whose templateURL query parameter points to attacker-controlled web-hosted content; the server then fetches that content and renders it into the deploy page (templateBody placeholder), per the deploy.html/deploy_ui.py source. LocalStack's local endpoints are unauthenticated by default, consistent with PR:N. Limiting factors: exploitation needs user interaction (UI:R) to load the crafted deploy URL, the deploy endpoint must be exposed (LocalStack is frequently bound to localhost in dev/CI, reducing remote reachability), and only LocalStack 4.9.2 is cited as affected.

Signals conflict and should be weighed carefully. The CVSS 3.1 base score is critical (9.6) with AV:N/AC:L/PR:N indicating a remotely reachable, low-complexity, unauthenticated trigger, but UI:R means a user must interact (load the crafted deploy URL) and S:C reflects the claimed crossing from the web UI into the LocalStack container. Against this, the EPSS probability is only 0.18% (7th percentile), which is low and sits in tension with the 'act_now' priority label - the two signals disagree, so treat 'act_now' as reflecting severity/exploitability of a known, fixed defect rather than evidence of mass exploitation. No CISA KEV listing is present in the input, so there is no confirmation of active exploitation; a public PoC reference exists (the cyberroute.github.io write-up), but it is not verified as working exploit code. A further discrepancy: the record is classified CWE-79 (XSS) and tagged XSS, yet the description claims arbitrary code execution 'in the context of the docker container' - the available sources do not fully reconcile whether impact is browser-side script execution via the rendered deploy page or genuine code execution inside the container; verify the actual impact boundary with the vendor/PR. LocalStack is predominantly a developer/CI tool, often bound to localhost, which materially limits real-world exposure versus the raw score. Net: a genuine, patch-worthy critical defect per the decision label, but the low EPSS, absence of KEV, user-interaction requirement, and typical localhost deployment argue against treating it as broad active-exploitation risk.

An attacker hosts malicious content at a web-accessible URL and gets a user to open the LocalStack CloudFormation deploy UI (/_localstack/cloudformation/deploy) with that URL supplied as the templateURL query parameter; the server renders the fetched content into the deploy page, causing it to execute in the LocalStack container/web context. A public PoC reference exists (a 2025-12-11 blog write-up), but it is not verified as working exploit code, and exploitation requires user interaction (UI:R) to load the crafted deploy URL.