Command injection in LocalStack

CRITICO 9.8CVE-2021-32090 · GHSA-hpr6-f4vq-mxch · PYSEC-2021-101 · Published 07/05/2021 · updated 17/06/2026

In breve

CVE-2021-32090 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda localstack, localstack (localstack).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.1%, superiore al 81.9% delle vulnerabilità.
Correzione: aggiornare a 0.12.10, 0.12.6.1 o successiva.

Package	Affected versions	Patched versions
localstack PyPI	`< 0.12.10< 0.12.6.1`	`0.12.100.12.6.1`
localstack localstack	`= 0.12.6`	No fix yet

The dashboard component of StackLift LocalStack allows attackers to inject arbitrary shell commands via the functionName parameter.

NVD description

The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

< 0.12.10< 0.12.6.1

0.12.100.12.6.1

= 0.12.6

No fix yet