CVE-2026-16763

MEDIUM

localstack serverless-localstack Configuration index.js os command injection

Title source: cna
STIX 2.1

Description

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.compose_file leads to os command injection. An attack has to be approached locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

References (6)

Core 6
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-382620 | localstack serverless-localstack Configuration index.js os command injection
https://vuldb.com/vuln/382620
Signature, Permissions Required signature permissions-required
VDB-382620 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/382620/cti
Third Party Advisory third-party-advisory
CVE-2026-16763 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-16763
Third Party Advisory third-party-advisory
Submit #861028 | Node.js serverless-localstack 1.4.0 OS Command Injection
https://vuldb.com/submit/861028

Scores

CVSS v3 5.3
EPSS 0.0070
EPSS Percentile 49.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-77 CWE-78
Status published
Products (5)
localstack/serverless-localstack 1.0
localstack/serverless-localstack 1.1
localstack/serverless-localstack 1.2
localstack/serverless-localstack 1.3
localstack/serverless-localstack 1.4.0
Published Jul 23, 2026
Tracked Since Jul 24, 2026