CVE-2025-65200

5.4 MEDIUMpublic exploit available

Published 2026-10-22 · Updated 2026-10-26

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the _localstack/cloudformation/deploy endpoint, the hosted content can get executed in the context of the docker container.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weaknesses

CWE-79

Public exploit & PoC references

https://github.com/localstack/localstack/blob/aba1ee84592d76f0a88dd286fcd83b65080e31ac/localstack-core/localstack/services/cloudformation/deploy_ui.py
https://github.com/localstack/localstack/pull/13293/

All references

http://localstack.com
https://cyberroute.github.io/post/2025-12-11-localstack-hack/
https://github.com/localstack/localstack/blob/aba1ee84592d76f0a88dd286fcd83b65080e31ac/localstack-core/localstack/services/cloudformation/deploy_ui.py
https://github.com/localstack/localstack/pull/13293/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2012-20003PoC
MEDIUMCVE-2012-20004PoC
MEDIUMCVE-2012-20005PoC
MEDIUMCVE-2014-125131PoC
MEDIUMCVE-2014-125132PoC
MEDIUMCVE-2016-20098PoC
MEDIUMCVE-2016-20102PoC
MEDIUMCVE-2017-20288PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.