Command injection in LocalStack

CRÍTICO 9.8CVE-2021-32090 · GHSA-hpr6-f4vq-mxch · PYSEC-2021-101 · Published 07/05/2021 · updated 17/06/2026

Em resumo

CVE-2021-32090 é uma vulnerabilidade CRÍTICO (CVSS 9.8) que afeta localstack, localstack (localstack).
Chance de exploração nos próximos 30 dias (EPSS): 2.1%, maior que 81.9% das vulnerabilidades.
Correção: atualize para 0.12.10, 0.12.6.1 ou posterior.

Package	Affected versions	Patched versions
localstack PyPI	`< 0.12.10< 0.12.6.1`	`0.12.100.12.6.1`
localstack localstack	`= 0.12.6`	No fix yet

The dashboard component of StackLift LocalStack allows attackers to inject arbitrary shell commands via the functionName parameter.

NVD description

The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

PyPI

< 0.12.10< 0.12.6.1

0.12.100.12.6.1

= 0.12.6

No fix yet