LocalStack EUVD-2025-211173

Exploitation requires a victim to open an attacker-crafted URL while interacting with the LocalStack 4.9.2 web interface; this user-interaction requirement (UI:R) is the primary limiting factor, as the attack cannot self-trigger. No authentication is required of the attacker (PR:N), and the attack is deliverable remotely over the network, but the specific vulnerable endpoint, parameter, or feature is not described in the available sources. Because this is reflected (not stored) XSS, the payload is not persisted and each attack depends on social-engineering a fresh victim click; impact is bounded to the victim's browser context, with no server-side confidentiality/integrity change beyond what the user's session allows.

This is a moderate-severity reflected XSS (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) that signals are consistent in rating as a real-but-not-urgent issue rather than a top-priority emergency. The CVSS vector shows network reach, low complexity, and no authentication, but execution hinges on UI:R - a victim must open an attacker-crafted URL - which inherently caps real-world exploitability. EPSS reinforces this with a very low 0.15% probability (4th percentile), and the vulnerability is NOT in CISA KEV, so there is no evidence of active exploitation; the vuln.today decision label is 'this_month', i.e. routine remediation rather than act_now/emergency. The low EPSS aligns with the low-impact (C:L/I:L/A:N) reflected XSS profile and the lack of KEV listing - nothing here conflicts. The main cross-source caveat is PoC provenance: the sole non-NVD reference is a third-party blog write-up, not confirmed working exploit code, so weaponization should not be assumed. Net: a legitimate flaw worth patching on a normal cycle, not a drop-everything priority.

An attacker crafts a malicious URL targeting the vulnerable LocalStack 4.9.2 endpoint and delivers it to a victim via phishing, chat, or a planted link. When the victim (an authenticated or unauthenticated user of the LocalStack interface) opens the link, attacker-controlled JavaScript reflects back and executes in their browser session, enabling session/token theft or UI actions in their context. A public PoC reference exists (a third-party blog), but it is not verified as working exploit code.