CVE-2021-32090: Command injection in LocalStack
Summary
CVE-2021-32090: Command injection in LocalStack. Affects localstack versions < 0.12.10. Fixed in 0.12.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LocalStack is a package available on PyPI that provides a local AWS cloud stack for testing and development purposes. It emulates various AWS services, allowing developers to work offline without the need for actual AWS resources. LocalStack includes a dashboard component that provides a web interface for managing and monitoring the emulated services. However, this component is vulnerable to command injection attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2021-32090, allows attackers to inject arbitrary shell commands through the 'functionName' parameter in the LocalStack dashboard. This parameter is not properly validated, enabling malicious actors to execute unauthorized commands on the underlying system. Exploiting this vulnerability can lead to various consequences, including unauthorized access, data leakage, and potential compromise of the entire system.
How To Fix
Latest published version: 2026.8.2 as of 23 Oct 2026
pip install --upgrade "localstack==2026.8.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.10
This is the first release that contains the fix.
pip install --upgrade "localstack==0.12.10"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling or restricting access to the LocalStack dashboard. This can be achieved by modifying the configuration or firewall rules to block incoming connections to the dashboard component. However, this workaround should only be considered as a temporary measure until the package can be updated to a secure version.
Conclusion
CVE-2021-32090 is a critical command injection vulnerability in the LocalStack package's dashboard component. It allows attackers to execute arbitrary shell commands, potentially leading to unauthorized access and compromise of the system. To mitigate this vulnerability, it is crucial to update the LocalStack package to version 0.12.10 or later. Additionally, temporarily disabling or restricting access to the dashboard can provide a workaround until the update is applied. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for localstack →
FAQ
LocalStack is a package that provides a local AWS cloud stack for testing and development purposes. It emulates various AWS services, allowing developers to work offline without the need for actual AWS resources.
The vulnerability, identified as CVE-2021-32090, is a command injection vulnerability in the LocalStack dashboard. Attackers can inject arbitrary shell commands through the 'functionName' parameter, potentially leading to unauthorized access and compromise of the system.
Exploiting this vulnerability can result in unauthorized access, data leakage, and potential compromise of the entire system. Attackers can execute arbitrary commands on the underlying system, leading to various malicious activities.
To fix this vulnerability, it is recommended to update the LocalStack package to version 0.12.10 or later. This update includes proper input validation and sanitization for the vulnerable parameter, preventing command injection attacks.
Yes, a temporary workaround is to disable or restrict access to the LocalStack dashboard. This can be achieved by modifying the configuration or firewall rules to block incoming connections to the dashboard component. However, updating to the latest secure version is still the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for localstack.
