123 matches found
cicd-goat
Deliberately vulnerable CI/CD environment. Hack CI/CD pipelines, capture the flags. 🚩 Created by Cider Security Acquired by Palo Alto Networks. Table of Contents Description Download & Run Linux & Mac Windows Powershell Usage Instructions Take the challenge Troubleshooting Solutions Contributing...
CVE-2022-27251
CVE-2022-27251 Remote Code Execution in LocalStack 0.12.6 Due to the lack of sanitization on user input on the Lambda API handler field whilst spawning Lambda functions and the way Docker containers are insecurely spawned, an injection can be provided through AWS CLI in the --handler option to be...
Cross-site Scripting (XSS)
Overview localstack-core is a The core library and runtime of LocalStack Affected versions of this package are vulnerable to Cross-site Scripting XSS via the CloudFormation deploy UI deployui.py and deploy.html, which renders server-side template placeholders such as templateBody, stackName, and...
localstack (>=4.0.0, <=4.9.2), localstack-ext (>=4.0.0, <=4.9.3.dev131) potentially affected by CVE-2025-65200 via localstack-core (>=4.0.0, <=4.9.3.dev77)
localstack-core PYPI version =4.0.0, =4.0.0, =4.0.0, =4.9.3.dev131 Source cves: CVE-2025-65200 Source advisory: SNYK:PYTHON-LOCALSTACKCORE-21692676...
GHSA-VXJ4-Q4G9-CRJ7 vulnerabilities
Vulnerabilities for packages: openstack-rally-2026.1, nemo-rl-cuda-13.0, nemo-gym, nemo-skills, openstack-rally-2025.2, request-1276, py3-cassandra-medusa, localstack...
CVE-2025-69723
A reflected cross-site scripting XSS vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL...
CVE-2025-65200
An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the localstack/cloudformation/deploy endpoint, the hosted content can get executed in the context of the...
CVE-2025-65200
An issue in localstack (version 4.9.2 ) allows attackers to achieve arbitrary code execution within a docker container context. The vulnerability occurs when a web-accessible URL containing crafted content is provided as the templateURL parameter to the _localstack/cloudformation/deploy endpoint....
localstack (>=4.0.0, <=4.9.2), localstack-ext (>=4.0.0, <=4.9.3.dev131) potentially affected by CVE-2025-69723 via localstack-core (>=4.0.0, <=4.9.3.dev77)
localstack-core PYPI version =4.0.0, =4.0.0, =4.0.0, =4.9.3.dev131 Source cves: CVE-2025-69723 Source advisory: MEND:CVE-2025-69723...
EUVD-2025-211173
A reflected cross-site scripting XSS vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL...
PT-2026-121502
A reflected cross-site scripting XSS vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL...
CVE-2025-69723
A reflected cross-site scripting XSS vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL...
CVE-2025-69723
A reflected cross-site scripting (XSS) vulnerability exists in localstack versions >=4.0.0 and =4.0.0 and =4.0.0 and
CVE-2025-69723
A reflected cross-site scripting XSS vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL...
CVE-2025-69723
A reflected cross-site scripting XSS vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL...
LocalStack security vulnerability
A security vulnerability exists in LocalStack version 4.9.2. It arises when a URL hosting specially crafted content is passed as templateURL to the localstack/cloudformation/deploy endpoint, potentially allowing arbitrary code execution within a Docker container environment...
CVE-2025-65200
An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the localstack/cloudformation/deploy endpoint, the hosted content can get executed in the context of the...
EUVD-2025-211174
An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the localstack/cloudformation/deploy endpoint, the hosted content can get executed in the context of the...
localstack (>=4.0.0, <=4.9.2), localstack-ext (>=4.0.0, <=4.9.3.dev131) potentially affected by CVE-2025-65200 via localstack-core (>=4.0.0, <=4.9.3.dev77)
localstack-core PYPI version =4.0.0, =4.0.0, =4.0.0, =4.9.3.dev131 Source cves: CVE-2025-65200 Source advisory: MEND:CVE-2025-65200...
CVE-2025-65200
An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the localstack/cloudformation/deploy endpoint, the hosted content can get executed in the context of the...