Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the _localstack/cloudformation/deploy endpoint, the hosted content can get executed in the context of the docker container.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🔴 remote code execution in cloudformation deploy endpoint (CVE-2025-65200) An attacker can execute code in the Docker container by submitting a crafted web-hosted URL to the deploy endpoint. No patch listed yet https://cve.now/CVE-2025-65200
A CVE-2025-65200 descreve uma vulnerabilidade no LocalStack 4.9.2, ferramenta usada para simular serviços AWS em ambientes de desenvolvimento. Ao receber uma URL maliciosa no parâmetro templateURL do endpoint de implantação do CloudFormation, o serviço pode executar código dentro do contêiner Docker. Para equipes que utilizam o LocalStack, vale verificar a versão em uso, restringir o acesso ao endpoint e consultar as orientações do projeto para mitigação. https://cve.now/CVE-2025-65200
LocalStack deploy GUI の XSS でコンテナ内コード実行｜CVE-2025-65200 https://ai-heartland.com/security/localstack-deploy-xss-rce/