CVE-2025-65200 in LocalStack
Summary
by MITRE • 10/22/2026
An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the _localstack/cloudformation/deploy endpoint, the hosted content can get executed in the context of the docker container.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in LocalStack version 4.9.2 represents a critical server-side request forgery and remote code execution flaw within its CloudFormation deployment mechanism. This issue specifically targets the _localstack/cloudformation/deploy endpoint, which is designed to process infrastructure-as-code templates provided by users or automated systems. The core of the vulnerability lies in how LocalStack handles external references within these template files. When a user submits a CloudFormation template that includes a templateURL parameter pointing to content hosted on an arbitrary web-accessible URL, the system retrieves and processes this remote content without sufficient validation or sanitization. This behavior allows attackers who can influence the input of such endpoints to direct LocalStack to fetch malicious payloads from servers under their control.
The technical flaw stems from the lack of strict allow-listing for source URLs and insufficient parsing logic when interpreting external template resources. In a standard CloudFormation workflow, templates are often stored in Amazon S3 buckets or other trusted repositories where access is controlled. However, LocalStack’s implementation permits fetching these templates from any HTTP endpoint accessible to the container environment. Once the malicious content is retrieved, it is parsed and executed within the context of the Docker container running LocalStack. This execution happens with the privileges assigned to that container, which often include significant permissions related to cloud resource management, network access, and potentially host-level interactions depending on how the container was configured.
The operational impact of this vulnerability is severe, as it effectively grants an attacker full remote code execution capabilities within the isolated environment hosting LocalStack. Since LocalStack simulates various AWS services such as Lambda functions, API Gateway, and S3 buckets, a successful exploit could lead to the compromise not only of the local development or testing infrastructure but also potentially impact connected systems if network policies are permissive. Attackers can leverage this access to exfiltrate sensitive data stored in simulated cloud resources, install backdoors for persistent access, pivot into other parts of the internal network, or disrupt services by manipulating stateful operations within the mocked environment. In development environments where LocalStack is commonly used, this could also lead to credential theft if secrets are managed through similar mechanisms exposed via the API.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor, as it allows unauthorized code execution and potential data leakage. From a MITRE ATT&CK perspective, this maps directly to T1505 Server Software Component: Web Shell or T1608 Install Defective Digital Certificate if used for persistence, but more accurately reflects T1190 Exploit Public-Facing Application due to the exploitation of an exposed API endpoint. The attack vector is classified as remote with low complexity, requiring only network access and knowledge of the LocalStack deployment URL.
Mitigation strategies should focus on restricting the sources from which templates can be fetched. Administrators should configure LocalStack to allow template retrieval only from trusted internal repositories or disable external template fetching entirely if not required for specific workflows. Implementing strict input validation that rejects URLs pointing to untrusted domains is essential. Additionally, running LocalStack with minimal privileges in a restricted network segment limits the blast radius of any potential compromise. Regular updates to LocalStack are critical as newer versions may have patched this behavior by enforcing stricter security controls on resource loading mechanisms. Security teams should also monitor API logs for unusual patterns involving external URL references in deployment requests to detect attempted exploitation early.