CVE-2025-65200

CriticalCVSS 9.6

Published: 22/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.55%

46th percentile - higher than 46% of all known CVEs

Summary

An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessible URL. When such a URL is passed as templateURL to the _localstack/cloudformation/deploy endpoint, the hosted content can be executed in the context of the Docker container.

Risk Assessment

An attacker can remotely execute arbitrary code in the context of the localstack Docker container, potentially leading to container compromise and access to data or resources.

Recommendation

Update localstack to a version containing the fix and restrict access to the _localstack/cloudformation/deploy endpoint, validating submitted URLs.

Other vulnerabilities in localstack

CVE-2025-69723Medium
A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary JavaScript in the context of the user's browser via a crafted URL.

Original NVD description (English source)

An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the _localstack/cloudformation/deploy endpoint, the hosted content can get executed in the context of the docker container.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS