Serverless Localstack
Monthly
OS command injection in localstack serverless-localstack up to version 1.4.0 allows a local low-privileged attacker to execute arbitrary operating system commands by manipulating the `custom.localstack.docker.compose_file` configuration argument processed by the Configuration Handler in `src/index.js`. A publicly available proof-of-concept exploit exists via GitHub issue #303, elevating practical risk beyond the moderate CVSS 4.0 base score of 4.8. No vendor patch has been released, as the project maintainer has not responded to the responsible disclosure reported through an issue report.
OS command injection in localstack serverless-localstack up to version 1.4.0 allows a local low-privileged attacker to execute arbitrary operating system commands by manipulating the `custom.localstack.docker.compose_file` configuration argument processed by the Configuration Handler in `src/index.js`. A publicly available proof-of-concept exploit exists via GitHub issue #303, elevating practical risk beyond the moderate CVSS 4.0 base score of 4.8. No vendor patch has been released, as the project maintainer has not responded to the responsible disclosure reported through an issue report.