Live › vulnerability › CVE-2025-69723
Go to dashboardLocalStack v4.9.2 reflects part of a crafted URL into a page without escaping it. A victim who opens such a link has attacker JavaScript run in their browser session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running LocalStack v4.9.2 locally or in CI where a developer can be lured to a crafted link while LocalStack is reachable from the browser. Teams not running that version can skip it.
No product ranges from the sources yet.
localstack --version or the image tag in your compose file.4.9.2 once a fixed release is published; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL.
This page as .md · .json · in your agent: get_signal("CVE-2025-69723")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.