2vulnerabilities
- Critical0 (0.0%)
- High2 (100.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
browserstack-runner
Ecosystem: npm
Downloads: 4.36 K
- 0CriticalAffects 0 versions
- 2HighAffects 2 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 2 vulnerabilities
- Critical: 0
- High: 2
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting browserstack-runner, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-6vr3-7wcx-v5g5 | High | browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler### Summary The HTTP handler `/_log` in `lib/server.js` (lines 491–515) of browserstack-runner passes unauthenticated user-supplied data to `vm.runInNewContext()` combined with `eval()`, enabling a sandbox escape and arbitrary code execution on the host system. ### Details When `browserstack-runner` starts, it creates an HTTP server on port 8888 (configurable) that listens on all network interfaces (`0.0.0.0`). The `/_log` endpoint accepts POST requests and processes the JSON body as follows: ```javascript // lib/server.js lines 504-510 var context = { input: query.arguments, format: util. |
| GitHub (opens in a new tab) | |
| GHSA-8rpw-6cqh-2v9h | High | browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server## Summary The HTTP server in browserstack-runner serves files from the project directory via the `_default` handler. This handler uses `path.join(process.cwd(), uri)` to resolve file paths but does not validate that the resulting path stays within the project root. Combined with the server binding on `0.0.0.0` (all interfaces) and the absence of any authentication, this allows an unauthenticated network-adjacent attacker to read arbitrary files from the host filesystem. ## Root Cause **lib/server.js, lines 530–534 : `_default` handler:** ```javascript '_default': function defaultHandler(u |
| GitHub (opens in a new tab) |
- GHSA-6vr3-7wcx-v5g5Highbrowserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler
<= 0.9.5
### Summary The HTTP handler `/_log` in `lib/server.js` (lines 491–515) of browserstack-runner passes unauthenticated user-supplied data to `vm.runInNewContext()` combined with `eval()`, enabling a sandbox escape and arbitrary code execution on the host system. ### Details When `browserstack-runner` starts, it creates an HTTP server on port 8888 (configurable) that listens on all network interfaces (`0.0.0.0`). The `/_log` endpoint accepts POST requests and processes the JSON body as follows: ```javascript // lib/server.js lines 504-510 var context = { input: query.arguments, format: util.
CVE: CVE-2026-49143
- GHSA-8rpw-6cqh-2v9hHighbrowserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server
<= 0.9.5
## Summary The HTTP server in browserstack-runner serves files from the project directory via the `_default` handler. This handler uses `path.join(process.cwd(), uri)` to resolve file paths but does not validate that the resulting path stays within the project root. Combined with the server binding on `0.0.0.0` (all interfaces) and the absence of any authentication, this allows an unauthenticated network-adjacent attacker to read arbitrary files from the host filesystem. ## Root Cause **lib/server.js, lines 530–534 : `_default` handler:** ```javascript '_default': function defaultHandler(u
CVE: CVE-2026-49144