CVE-2026-51190: Serverless-Devs RCE Vulnerability

CVE-2026-51190 Overview

CVE-2026-51190 is an OS command injection vulnerability in the Serverless-Devs @serverless-devs/s command-line tool at versions <= 3.1.11. The s init command passes unsanitized user input directly to Node.js child_process.spawn() with the shell: true option. The tool's only input check can be bypassed by supplying a URL ending in .git, permitting arbitrary shell command execution. An attacker who can influence the argument passed to s init gains code execution in the context of the invoking user.

Critical Impact
An attacker-controlled argument to s init executes arbitrary operating system commands under the developer or CI account running the Serverless-Devs CLI.

Affected Products

Serverless-Devs @serverless-devs/s versions <= 3.1.11
The s init subcommand of the Serverless-Devs CLI
Developer workstations and CI/CD pipelines invoking s init with external input

Discovery Timeline

2026-08-03 - CVE-2026-51190 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-51190

Vulnerability Analysis

The Serverless-Devs CLI provides s init to scaffold new projects, optionally cloning a template from a Git URL. The implementation forwards the user-supplied argument to child_process.spawn() with shell: true. When shell: true is set, Node.js invokes /bin/sh -c (or cmd.exe on Windows) and interprets shell metacharacters such as ;, |, &&, and backticks. The command handler applies a single validation step that checks whether the argument ends with .git. Any string satisfying that suffix passes the check, including payloads that embed shell metacharacters before the trailing .git. This maps to command injection [CWE-78].

Root Cause

The root cause is the combination of shell-mode process spawning and inadequate input validation. Using shell: true with concatenated user input creates a shell metacharacter injection surface. The suffix check on .git validates only the final characters of the string, not the presence of shell control operators. Safe usage requires either passing arguments as an array without shell: true or strictly validating the input against an allow-list pattern for Git URLs.

Attack Vector

An attacker crafts a value that ends in .git but contains shell metacharacters, for example a string of the form "; <injected-command>; echo .git. When a developer or automated pipeline runs s init and passes the attacker-controlled value, the injected command executes in the shell before or after the intended clone operation. Delivery paths include malicious template documentation, poisoned onboarding instructions, supply-chain guidance, or automated systems that construct the argument from untrusted input. The injected process inherits the privileges of the invoking user.

Detection Methods for CVE-2026-51190

Indicators of Compromise

Shell history entries containing s init invocations with unusual characters such as ;, |, &&, backticks, or $() preceding .git
Child processes of node or s spawning shells (sh, bash, cmd.exe) followed by unexpected binaries such as curl, wget, nc, or powershell
Outbound network connections from developer or build hosts to unfamiliar hosts immediately after s init executes
New files, cron jobs, or scheduled tasks created under the user account that ran s init

Detection Strategies

Monitor process-creation telemetry for s or node processes whose command line contains init together with shell metacharacters
Alert on shell interpreter processes launched as descendants of the Serverless-Devs CLI
Inspect CI/CD job logs for s init arguments that do not match a strict Git URL pattern
Correlate s init execution with subsequent anomalous outbound connections or credential-file reads

Monitoring Recommendations

Ingest developer workstation and build-agent EDR telemetry into a central data lake for process-lineage queries
Track versions of @serverless-devs/s deployed across engineering environments and flag installations at or below 3.1.11
Enable command-line auditing on Windows and execve auditing on Linux build hosts

How to Mitigate CVE-2026-51190

Immediate Actions Required

Upgrade @serverless-devs/s beyond version 3.1.11 on all developer workstations and CI/CD runners
Audit automation that constructs arguments to s init and remove any path that accepts untrusted input
Review shell history and CI logs for prior s init invocations containing shell metacharacters
Rotate credentials that were accessible to accounts running vulnerable versions of the CLI

Patch Information

Refer to the GitHub Gist Vulnerability Report for the technical write-up. Track the upstream @serverless-devs/s repository for a fixed release above 3.1.11 and apply it as soon as it is available.

Workarounds

Avoid running s init with any argument sourced from untrusted documentation, chat messages, or web input
Restrict template URLs to a known allow-list of internal Git hosts before invoking the CLI
Run the Serverless-Devs CLI inside an ephemeral, unprivileged container to limit the blast radius of command injection
In CI/CD, validate template arguments against a strict regular expression matching only well-formed Git URLs before passing them to s init

bash

# Configuration example: validate a Git URL before invoking s init
TEMPLATE_URL="$1"
if [[ ! "$TEMPLATE_URL" =~ ^https://(github|gitlab)\.example\.com/[A-Za-z0-9._/-]+\.git$ ]]; then
  echo "Rejected template URL: $TEMPLATE_URL" >&2
  exit 1
fi
s init "$TEMPLATE_URL"