CVE-2025-69723

MediumCVSS 6.1

Published: 22/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary JavaScript in the context of the user's browser via a crafted URL.

Risk Assessment

An attacker can trick a user into clicking a crafted link, executing malicious script in their browser and potentially hijacking the session or data.

Recommendation

Update localstack to a version containing the fix or implement proper input filtering and encoding in the application.

Other vulnerabilities in localstack

CVE-2025-65200Critical
An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessible URL. When such a URL is passed as templateURL to the _localstack/cloudformation/deploy endpoint, the hosted content can be executed in the context of the Docker container.

Original NVD description (English source)

A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS