CVE-2026-51190

Received Received - Intake

Command Injection in Serverless-Devs via Malicious Git URL

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: MITRE

Description

The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-03

Last Modified

2026-08-03

Generated

2026-08-04

AI Q&A

2026-08-04

EPSS Evaluated

N/A

NVD

CVE-2026-51190

Affected Vendors & Products

Vendor	Product	Version / Range
serverless_devs	serverless_devs	to 3.1.11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an OS command injection flaw in Serverless-Devs versions 3.1.11 and earlier. The 's init' command improperly handles user input by passing it directly to a system command with shell access enabled. An attacker can exploit this by providing a specially crafted URL ending in '.git', which bypasses input validation and executes arbitrary commands on the system.

Detection Guidance

To detect this vulnerability, check if Serverless-Devs version 3.1.11 or earlier is installed using 'npm list @serverless-devs/s'. If installed, inspect any usage of the 's init' command with user-provided input, especially URLs ending in '.git'.

Impact Analysis

If exploited, this vulnerability could allow attackers to run unauthorized commands on your system with the same privileges as the user running Serverless-Devs. This could lead to data theft, system compromise, installation of malware, or disruption of services. Users running vulnerable versions should update immediately.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Upgrade Serverless-Devs to a version higher than 3.1.11 where the vulnerability is patched. Avoid using the 's init' command with untrusted input until patched.

Hi! I’m here to help you understand CVE-2026-51190. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70