CVE-2026-16763

Name of the Vulnerable Software and Affected Versions localstack serverless-localstack versions prior to 1.4.1

Description An OS command injection issue exists within the Configuration Handler component in the src/index.js file. This occurs when the custom.localstack.docker.compose file argument is manipulated, allowing for the execution of arbitrary operating system commands. This issue requires local access to be exploited.

Recommendations Update localstack serverless-localstack to a version newer than 1.4.0. Avoid using the custom.localstack.docker.compose file argument until the software is updated.