CVE-2026-108598: Floci Velocity SSTI Code Injection Vulnerability — Analysis & Mitigation
Floci , the open-source AWS API Gateway emulator, shipped version 2.2.0 this month to fix CVE-2026-108598 , a critical server-side template injection vulnerability that hands unauthenticated attackers full operating-system command execution on the host. An attacker creates a REST API with a MOCK integration, drops in a Velocity mapping template that uses $util reflection, and walks straight into Java's Runtime or ProcessBuilder . It is also a textbook failure of identity access management : the endpoint that creates APIs and writes executable templates asks for no identity at all. Summary Floci emulates AWS API Gateway for local development and testing, letting teams build and test API definitions without touching real AWS infrastructure. Its VtlTemplateEngine component renders Apache Velocity mapping templates for MOCK integrations — the feature that lets a fake API return canned responses. CVE-2026-108598 is a CWE-94 code injection flaw: Floci 1.1.0 before 2.2.0 placed n...