{"id":"CVE-2025-65200","kind":"vulnerability","aliases":["CVE-2025-65200"],"related":[],"title":"LocalStack: crafted CloudFormation template URL runs code in container","description":"An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the _localstack/cloudformation/deploy endpoint, the hosted content can get executed in the context of the docker container.","summary":"LocalStack 4.9.2 fetches a CloudFormation template from a URL passed to its deploy endpoint, and the fetched content is executed inside the Docker container. An attacker who controls a web-hosted file and can submit a deploy request can run arbitrary code in that container.","severity":"unknown","cvss":null,"epss":0.00181,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws-emulation","ci","docker","infrastructure","localstack"],"not_affected_if":["default-config"],"how_to_check":"- Run `localstack --version` or check the image tag in use and confirm whether it is `4.9.2`\n- Check whether the `_localstack/cloudformation/deploy` endpoint is reachable from untrusted networks","fix":null,"status":"open","published_at":"2026-10-22T19:17:32+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T05:00:23+00:00","updated_at":"2026-10-25T05:00:23+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:00:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"LocalStack: crafted CloudFormation template URL runs code in container","impact":"high","summary":"LocalStack 4.9.2 fetches a CloudFormation template from a URL passed to its deploy endpoint, and the fetched content is executed inside the Docker container. An attacker who controls a web-hosted file and can submit a deploy request can run arbitrary code in that container.","category":"infrastructure","nicknames":[],"who_cares":["localstack","docker","aws-emulation","ci"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker code runs inside the LocalStack Docker container","analyst_note":"Find the fixed LocalStack version and whether the deploy endpoint requires auth, via the NVD entry and the LocalStack project's advisory or changelog.","how_to_check":"- Run `localstack --version` or check the image tag in use and confirm whether it is `4.9.2`\n- Check whether the `_localstack/cloudformation/deploy` endpoint is reachable from untrusted networks","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams running LocalStack 4.9.2 where the CloudFormation deploy endpoint accepts requests from users or networks they do not fully trust. Exposure depends on who can reach the endpoint and whether it is limited to local developer use. Teams on other versions or with the endpoint closed off are not described by the sources as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00061,"input_tokens":3357,"output_tokens":548,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':11A,14A '-65200':12A,15A '4.9.2':24B,75C 'access':90C 'allow':76C 'arbitrari':64B,80C 'attack':48B,77C 'aw':17B 'aws-emul':16B 'ci':19B 'cloudform':3A,27B 'code':7A,65B,81C 'contain':9A,46B,68B,117C 'content':40B,84C,107C 'context':113C 'control':50B 'craft':2A,83C 'cve':10A,13A 'deploy':35B,60B 'discov':72C 'docker':20B,45B,116C 'emul':18B 'endpoint':36B,104C 'execut':42B,79C,110C 'fetch':25B,39B 'file':55B 'get':109C 'host':54B,85C,106C 'infrastructur':21B 'insid':43B 'issu':70C 'localstack':1A,22B,23B,74C 'localstack/cloudformation/deploy':103C 'pass':32B,94C 'request':61B 'run':6A,63B 'said':95C 'submit':58B 'templat':4A,28B 'templateurl':100C 'url':5A,31B,91C,96C 'via':82C 'web':53B,89C 'web-access':88C 'web-host':52B","nicknames":[],"mitigations":[],"who_affected":"Teams running LocalStack 4.9.2 where the CloudFormation deploy endpoint accepts requests from users or networks they do not fully trust. Exposure depends on who can reach the endpoint and whether it is limited to local developer use. Teams on other versions or with the endpoint closed off are not described by the sources as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T19:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-65200","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65200","severity":null,"published_at":"2026-10-22T19:17:32+00:00","modified_at":"2026-10-23T19:43:46+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2025-65200","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-65200","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}