Command Injection

Overview browserstack-cypress-cli is a BrowserStack Cypress CLI for Cypress integration with BrowserStack's remote devices. Affected versions of this package are vulnerable to Command Injection via the loadJsFile process in readCypressConfigUtil. An attacker can execute arbitrary commands by...

CVE-2026-48723

The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via the cypressconfigfile configuration parameter. In readCypressConfigUtil.js, the loadJsFile function constructs a shell...

CVE-2026-48723

BrowserStack Cypress CLI prior to 1.36.4 is vulnerable to OS command injection via the cypress_config_file parameter in readCypressConfigUtil.js (loadJsFile()), which builds a shell command by interpolating cypress_config_filepath into a template literal and runs it with child_process.execSync()....

CVE-2026-48723 BrowserStack Cypress CL: Command Injection via cypress_config_file leads to arbitrary code execution through malicious browserstack.json

The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via the cypressconfigfile configuration parameter. In readCypressConfigUtil.js, the loadJsFile function constructs a shell...

CVE-2026-48723: Improper Neutralization of Special Elements used in an OS Command

The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via the cypressconfigfile configuration parameter. In readCypressConfigUtil.js, the loadJsFile function constructs a shell...

browserstack-cypress-cli (>=1.14.1, <=1.36.3) potentially affected by CVE-2025-57283 via browserstack-local (>=1.5.1, <=1.5.4)

browserstack-local NPM version =1.5.1, =1.14.1, =1.36.3 Source cves: CVE-2025-57283 Source advisory: SNYK:JS-BROWSERSTACKLOCAL-15149317...