CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2021-32091
A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- localstack:localstack
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-37m5-42qp-4qpr | PyPI | localstack | <=0.12.10 | no fix published |
| PYSEC-2021-102 | PyPI | localstack | <0.12.6.1 | 0.12.6.1 |
References
- https://blog.sonarsource.com/hack-the-stack-with-localstack
- https://portswigger.net/daily-swig/localstack-zero-day-vulnerabilities-chained-to-achieve-remote-takeover-of-local-instances
- https://blog.sonarsource.com/hack-the-stack-with-localstack
- https://portswigger.net/daily-swig/localstack-zero-day-vulnerabilities-chained-to-achieve-remote-takeover-of-local-instances