CVE-2025-69723: XSS

Published Oct 22, 2026

Updated

A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL.

Affected Software

1 affected component

localstack localstack=4.9.2

Event History

Oct 22, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

Which installations should be treated as potentially affected?

The reported affected release is LocalStack v4.9.2. The available data does not identify other affected or fixed versions.

What must occur for exploitation?

An attacker needs to get a user to open a crafted URL. The JavaScript then executes in that user's browser context.

How can I check whether an environment is in scope?

Check the deployed LocalStack version. Environments running v4.9.2 should be considered potentially exposed based on the report.

CVE-2025-69723: XSS

Affected Software

Event History

Frequently Asked Questions

Which installations should be treated as potentially affected?

What must occur for exploitation?

How can I check whether an environment is in scope?

Company

Resources

Contact

Frequently Asked Questions

Which installations should be treated as potentially affected?

What must occur for exploitation?

How can I check whether an environment is in scope?