CVE-2026-16763

Received Received - Intake

OS Command Injection in LocalStack Serverless

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: VulDB

Description

A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.compose_file leads to os command injection. An attack has to be approached locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-23

Generated

2026-07-24

AI Q&A

2026-07-24

EPSS Evaluated

N/A

NVD

CVE-2026-16763

Affected Vendors & Products

Vendor	Product	Version / Range
localstack	serverless-localstack	to 1.4.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is an OS command injection vulnerability in localstack serverless-localstack up to version 1.4.0. It exists in the Configuration Handler component, specifically in the handling of the custom.localstack.docker.compose_file argument in src/index.js. An attacker can manipulate this argument to inject and execute arbitrary operating system commands locally.

Detection Guidance

Check if localstack serverless-localstack up to version 1.4.0 is installed. Inspect src/index.js for improper handling of the custom.localstack.docker.compose_file argument. Look for unusual command execution patterns or unexpected processes spawned locally.

Impact Analysis

If you use localstack serverless-localstack up to 1.4.0, an attacker with local access could execute arbitrary commands on your system. This could lead to unauthorized data access, system compromise, or further network infiltration. The exploit is publicly available, increasing the risk of misuse.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Compliance may be impacted if the vulnerability results in data breaches or unauthorized system access, potentially leading to legal penalties or loss of certification.

Mitigation Strategies

Update localstack serverless-localstack to a version beyond 1.4.0 if available. Remove or restrict write access to src/index.js. Monitor for local command injection attempts. Disable or sandbox the affected configuration handler component.

Hi! I’m here to help you understand CVE-2026-16763. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70