| शीर्षक | Node.js serverless-localstack 1.4.0 OS Command Injection |
|---|
| विवरण | serverless-localstack passes the custom.localstack.docker.compose_file configuration value directly into a shell command when autostart is enabled and the plugin starts LocalStack through Docker Compose.
The README documents docker.compose_file as an optional Docker Compose file path:
custom:
localstack:
autostart: true
docker:
compose_file: /home/localstack_compose.yml
However, in src/index.js, the value is interpolated into a command string:
exec(`docker-compose -f ${this.config.docker.compose_file} up -d`)
Because the value is not escaped or passed as an argument array, shell metacharacters in the compose file path can execute additional commands.
|
|---|
| स्रोत | ⚠️ https://github.com/localstack/serverless-localstack/issues/303 |
|---|
| उपयोगकर्ता | wjm2 (UID 99050) |
|---|
| सबमिशन | 17/06/2026 09:18 AM (1 महीना पहले) |
|---|
| संयम | 23/07/2026 04:06 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 382620 [localstack serverless-localstack तक 1.4.0 Configuration src/index.js custom.localstack.docker.compose_file अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|