CVE-2026-51190
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument.
Risk Assessment
An attacker can execute arbitrary system commands on the victim's machine, leading to full compromise of the development environment or server.
Recommendation
It is recommended to update @serverless-devs/s to a version above 3.1.11 and avoid running "s init" with untrusted arguments.
Original NVD description (English source)
The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument.