CVE-2025-69723 in LocalStack
Summary
by MITRE • 10/22/2026
A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
LocalStack version 4.9.2 contains a critical security flaw classified as a Reflected Cross-Site Scripting (XSS) vulnerability within its web-based management interface or API gateway components. This specific weakness arises from inadequate sanitization and validation of user-supplied input before it is processed by the application's backend logic. When an attacker crafts a malicious URL containing specially constructed JavaScript code, this payload is reflected back to the victim's browser without proper encoding or filtering mechanisms being applied. The vulnerability stems directly from CWE-79, which defines Improper Neutralization of Input During Web Page Generation, commonly known as XSS. In this scenario, the application fails to distinguish between executable script content and safe textual data, allowing arbitrary code injection into the HTML response stream that is subsequently rendered by the client-side browser environment.
The operational impact of this vulnerability is significant because it enables attackers to execute arbitrary JavaScript in the context of the user's session with LocalStack. Since LocalStack often serves as a local cloud service emulator used for development and testing, users may interact with sensitive configuration data or manage resources through its interface. An attacker leveraging this flaw can perform actions such as stealing session cookies, hijacking administrative sessions, performing unauthorized API calls on behalf of the victim, or redirecting users to phishing sites. The attack vector is primarily web-based, relying on social engineering tactics where a user must be tricked into visiting the crafted URL. This aligns with MITRE ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution, which allows adversaries to run scripts within the browser sandbox to achieve further objectives such as credential theft or lateral movement if the local environment is connected to broader network resources.
Mitigation strategies must focus on immediate remediation and defensive coding practices. The most effective solution is to upgrade LocalStack to a patched version where this input validation issue has been resolved by the development team. Until an update is available, administrators should implement strict output encoding for all user-supplied data before it is rendered in HTML responses. This includes applying context-aware escaping techniques such as HTML entity encoding for text content and ensuring that any dynamic content inserted into JavaScript variables or event handlers is properly sanitized using established libraries like DOMPurify. Additionally, deploying a Web Application Firewall (WAF) can provide an additional layer of defense by detecting and blocking known XSS payloads in HTTP requests. Security teams should also enforce Content Security Policy headers to restrict the sources from which scripts can be loaded, thereby mitigating the impact even if some malicious code manages to bypass input validation controls. Regular security audits and static application security testing are recommended to identify similar vulnerabilities across other components of the LocalStack infrastructure.