CVE-2026-51190

CRITICAL

Serverless-Devs @serverless-devs/s <= 3.1.11 - OS Command Injection via 's init' Git URL Bypass

Title source: llm

Description

The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument.

References (1)

Core 1

Core References

https://gist.github.com/j311yl0v3u/5600afea3bea1337805c2e335bd4ae8e

Scores

CVSS v3 9.8

EPSS 0.0104

EPSS Percentile 61.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-78

Status published

Published Aug 03, 2026

Tracked Since Aug 04, 2026