CVE-2026-16763 Details
Description
A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration Handler. The manipulation of the argument custom.localstack.docker.compose_file leads to os command injection. An attack has to be approached locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
An OS command injection vulnerability has been identified in Localstack's serverless-localstack plugin, affecting versions through 1.4.0. The issue arises in the Configuration Handler component, specifically within an unknown function in src/index.js. The vulnerability is triggered by manipulating the custom.localstack.docker.compose_file argument, leading to arbitrary command execution. This exploitation must be performed locally, and the available exploit could be used in the wild.
Users can avoid this vulnerability by not using the 'autostart' feature with a crafted Docker Compose file path. If the plugin is needed, manually start LocalStack without using Docker Compose.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 23, 2026CISA-ADP
Assessed Jul 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/localstack/serverless-localstack/ | [email protected] | Vendor |
| https://github.com/localstack/serverless-localstack/issues/303 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-16763 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/861028 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/382620 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/382620/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| localstack serverless-localstack | <= 1.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Modified | CISA-ADP |
| Jul 23, 2026 | New CVE Received | [email protected] |