Executive brief
Serverless-Devs is a development framework for building serverless applications. The "s init" command in versions up to 3.1.11 contains a critical flaw that allows attackers to execute arbitrary operating system commands on a developer's machine by passing a specially crafted URL. This could lead to theft of credentials, deployment tokens, or compromise of CI/CD pipelines, particularly in Kubernetes environments where service account tokens may be accessible.
Technical details
The vulnerability is an OS command injection (CWE-78) in the s init command handler (src/command/init/index.ts). User input from process.argv[3] is passed unsanitized to child_process.spawn() with shell: true, which causes Node.js to concatenate arguments and pass them to /bin/sh -c for execution. A bypassable input check only validates that the input ends with ".git", which can be trivially circumvented by appending shell metacharacters after the .git suffix (e.g., "https://evil.com/repo.git; malicious_command; echo .git"). No authentication or special privileges are required; the attacker simply needs a victim to execute s init with an attacker-controlled URL argument, typically via social engineering, supply-chain compromise of template repositories, or CI/CD pipeline tampering. Patches or version fixes are not mentioned in the advisory text.
Affected products
- Serverless-Devs s <= 3.1.11
Timeline
- 2026-08-03: disclosed
- 2026-04-17: other: Vulnerability report published on GitHub Gist