This vulnerability in localstack serverless-localstack (versions 1.0 through 1.4.0) involves an OS command injection due to unsafe manipulation of the custom.localstack.docker.compose_file argument in the Configuration Handler component (src/index.js). An attacker with local access can exploit this flaw to execute arbitrary operating system commands. Although a public exploit is available, the vendor has not issued any official remediation or patch as of the publication date.

Successful exploitation allows a local attacker to execute arbitrary OS commands on the affected system, potentially leading to unauthorized actions or system compromise. However, exploitation requires local access, limiting the attack surface. No known exploits in the wild have been reported.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should restrict local access to trusted users only and monitor for suspicious activity related to the vulnerable component. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.