The vulnerability is in the "s init" command of Serverless‑Devs @serverless‑devs/s up to version 3.1.11. It passes user‑supplied input directly to child_process.spawn() with the shell option enabled, and the only input validation that blocks most non-".git" URLs is bypassed by URLs ending in ".git". This flaw allows an attacker to inject arbitrary operating system commands, resulting in remote code execution with the privileges of the process executing the command.

Users running Serverless‑Devs @serverless‑devs/s version 3.1.11 or earlier are affected. No specific vendor product listing is provided beyond the package name and its version cutoff.

The flaw permits full command execution when an attacker controls the argument to "s init", making it a high‑severity risk. The EPSS score is 1%, and the vulnerability is not listed in CISA's KEV catalog, indicating no publicly known exploit has been reported to date. Nevertheless, due to the nature of the vulnerability and the ease of exploitation via a simple URL injection, the risk is significant. The likely attack vector is remote: anyone able to invoke the "s init" command with a crafted URL can achieve the exploit.