PT-2026-64183 · Localstack · Serverless-Localstack

Wjm2 · CVE-2026-16763 · Publicado 2026-07-23 · Atualizado 2026-07-23

NVD

CVSS v2.0

4.3

Média

Vetor base

AV:L/AC:L/Au:S/C:P/I:P/A:P

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.compose file leads to os command injection. An attack has to be approached locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Correção

Command Injection

OS Command Injection

Enumeração de Fraquezas

CWE-77

CWE-78

Identificadores relacionados

CVE-2026-16763

Produtos afetados

Serverless-Localstack

Referências · 7

• 🔥 https://github.com/localstack/serverless-localstack/issues/303 · Exploit
• https://vuldb.com/vuln/382620/cti · Nota
• https://github.com/localstack/serverless-localstack · Nota
• https://vuldb.com/submit/861028 · Nota
• https://vuldb.com/vuln/382620 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-16763 · Nota de Segurança
• https://vuldb.com/cve/CVE-2026-16763 · Nota