PT-2026-64183 · Localstack · Serverless-Localstack

Wjm2 · CVE-2026-16763 · Published 2026-07-23 · Updated 2026-07-23

NVD

CVSS v2.0

4.3

Medium

Base vector

AV:L/AC:L/Au:S/C:P/I:P/A:P

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.compose file leads to os command injection. An attack has to be approached locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploit

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-16763

Affected Products

Serverless-Localstack

References · 7

• 🔥 https://github.com/localstack/serverless-localstack/issues/303 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-16763 · Security Note
• https://vuldb.com/vuln/382620/cti · Note
• https://github.com/localstack/serverless-localstack · Note
• https://vuldb.com/submit/861028 · Note
• https://vuldb.com/vuln/382620 · Note
• https://vuldb.com/cve/CVE-2026-16763 · Note