A reflected cross‑site scripting flaw in LocalStack version 4.9.2 lets an attacker embed malicious JavaScript in a crafted URL, which is executed in the victim’s browser when the URL is visited. The payload runs with the privileges of the user’s browser context, potentially enabling session hijacking, credential theft, or further malicious activity. The weakness resides in insufficient input sanitization before rendering user‑supplied data, as defined by CWE‑79.

LocalStack, specifically the 4.9.2 release. Systems running this exact version without an update are susceptible to the vulnerability.

Based on the description, it is inferred that the vulnerability requires the user to open a malicious link, making the attack vector client‑side via social engineering or compromised sites. The CVSS score is 6.1, and the EPSS score is < 1%; the issue is not listed in the CISA KEV catalog. While the potential damage is significant—any compromised user can execute arbitrary JavaScript—no public exploits have been reported, suggesting a moderate exploitation likelihood. Administrators should treat the flaw as a moderate risk that could be elevated if an attacker achieves a large user base.