A reflected cross-site scripting flaw in LocalStack version 4.9.2 lets an attacker embed malicious JavaScript in a crafted URL, which is executed in the victim’s browser when the URL is visited. The payload runs with the privileges of the user’s browser context, potentially enabling session hijacking, credential theft, or further malicious activity. The weakness resides in insufficient input sanitization before rendering user‑supplied data, as defined by CWE‑79.

LocalStack, specifically the 4.9.2 release. Systems running this exact version without an update are susceptible to the vulnerability.

The vulnerability is client‑side and requires the user to open a malicious link; therefore the attack vector is lateral via social engineering or compromised sites. No CVSS or EPSS score is currently available, nor is the issue listed in the CISA KEV catalog. While the potential damage is significant—any compromised user can execute arbitrary JavaScript—no public exploits have been reported, suggesting a moderate exploitation likelihood. Administrators should treat the flaw as a moderate risk that could be elevated if an attacker achieves a large user base.