serverless-localstack CVE-2026-16763

Exploitation requires local access to the system (AV:L) and a low-privileged user account (PR:L per CVSS 4.0 vector). The attacker must have the ability to control or write to the Serverless Framework configuration file that supplies the custom.localstack.docker.compose_file argument - this limits exploitation to users with filesystem write access to the project directory or the ability to influence configuration inputs fed to the plugin. The vulnerability is triggered when the Configuration Handler in src/index.js actively processes this parameter, meaning the Serverless Framework must be invoked (e.g., via serverless deploy or serverless offline) after the malicious value is injected. Remote unauthenticated exploitation is not possible given the local attack vector. Impact is further bounded to low confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no lateral movement to subsequent systems per the CVSS vector.

The CVSS 4.0 base score of 4.8 (Medium) accurately reflects the constrained attack surface: AV:L requires local system access, PR:L requires a low-privileged account, and the impact triad (VC:L/VI:L/VA:L) indicates limited, non-critical consequences with no scope change to subsequent systems (SC:N/SI:N/SA:N). The exploit maturity modifier E:P (proof-of-concept publicly available) is a meaningful risk amplifier - developers with the PoC can trivially exercise this path. Critically, this is a development toolchain component, meaning it is most commonly run on developer workstations or CI/CD build agents rather than production infrastructure; the realistic threat actor is a malicious insider, a compromised build system, or a developer who inadvertently processes an attacker-controlled serverless.yml. KEV status is not confirmed, and no EPSS data was provided in the input. The absence of a vendor response to responsible disclosure is a compounding factor: no official patch timeline exists, leaving users without a clear remediation path beyond manual mitigations.

A developer or CI build agent with local access and a low-privilege account modifies the custom.localstack.docker.compose_file value in the project's serverless.yml to include shell metacharacters - for example, setting the value to docker-compose.yml; malicious_command. When the Serverless Framework invokes the serverless-localstack plugin and the Configuration Handler in src/index.js processes this parameter, the injected command executes with the privileges of the invoking process. A public proof-of-concept demonstrating this technique is available via GitHub issue #303.