CVE-2026-49143 BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContex...

CVE-2026-49143

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContex...

CVE-2026-49143 BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContex...

BrowserStack Runner path traversal vulnerability

BrowserStack Runner is an open-source browser testing command-line tool developed by BrowserStack. Versions of BrowserStack Runner prior to 0.9.5 contained a path traversal vulnerability. This vulnerability originated from the default HTTP handler in lib/server.js, which allowed for path traversa...

PT-2026-45857

Name of the Vulnerable Software and Affected Versions BrowserStack Runner versions prior to 0.9.6 Description An issue in the / log HTTP handler allows unauthenticated network-adjacent attackers to execute arbitrary code on the host system. The handler processes JSON request bodies by passing...

CVE-2026-49143: Improper Control of Generation of Code

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContex...

CVE-2026-49144: Improper Limitation of a Pathname to a Restricted Directory

BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside...

BrowserStack Runner code injection vulnerability

BrowserStack Runner is an open-source browser testing command-line tool developed by BrowserStack. Versions of BrowserStack Runner prior to 0.9.5 contained a code injection vulnerability. This vulnerability stems from the log HTTP handler, where data provided by users is passed to...

CVE-2026-25244 WebdriverIO has Command Injection in the BrowserStack Service

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution RCE in test orchestration. Git permits branch names containing shell...

CVE-2026-25244 WebdriverIO has Command Injection in the BrowserStack Service

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution RCE in test orchestration. Git permits branch names containing shell...

CVE-2026-25244 WebdriverIO has Command Injection in the BrowserStack Service

WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution RCE in test orchestration. Git permits branch names containing shell...

@elliemae/pui-e2e-test-sdk (>=0.1.0, <=12.4.4), @iamkenos/ellie (>=1.0.0, <=2.0.4) +10 more potentially affected by CVE-2026-25244 via @wdio/browserstack-service (>=5.18.7, <=9.23.0)

@wdio/browserstack-service NPM version =5.18.7, =0.1.0, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =1.0.1, =1.0.1, =0.0.1, =1.0.0, =1.0.2 Source cves: CVE-2026-25244 Source advisory: MEND:CVE-2026-25244...

CVE-2026-25244

CVE-2026-25244 affects WebdriverIO versions below 9.24.0, specifically the @wdio/browserstack-service during test orchestration. The root cause is user-controlled git branch names being interpolated directly into execSync() calls within getGitMetadataForAISelection() without sanitization, enablin...

@elliemae/pui-e2e-test-sdk (>=11.0.0, <=12.4.4), froth-webdriverio-framework (>=7.0.119-dev1.0, <=9.0.6-ytlc7.5) potentially affected by CVE-2026-25244 via @wdio/browserstack-service (>=9.12.7, <=9.23.0)

@wdio/browserstack-service NPM version =9.12.7, =11.0.0, =7.0.119-dev1.0, =9.0.6-ytlc7.5 Source cves: CVE-2026-25244 Source advisory: GHSA-5C46-X3QW-Q7J7...

Command Injection

Overview @wdio/browserstack-service is a WebdriverIO service for better Browserstack integration Affected versions of this package are vulnerable to Command Injection via the getGitMetadataForAISelection function. An attacker can execute arbitrary commands on the host system by supplying a...

WebdriverIO BrowserStack Service has a Command Injection issue

Summary A command injection vulnerability exists in @wdio/browserstack-service that allows remote code execution RCE when processing git branch names in test orchestration. An attacker can exploit this by providing a malicious git repository with a branch name containing shell command injection...

GHSA-5C46-X3QW-Q7J7 WebdriverIO BrowserStack Service has a Command Injection issue

Summary A command injection vulnerability exists in @wdio/browserstack-service that allows remote code execution RCE when processing git branch names in test orchestration. An attacker can exploit this by providing a malicious git repository with a branch name containing shell command injection...

@elliemae/pui-e2e-test-sdk (>=11.0.0, <=12.4.4), froth-webdriverio-framework (>=7.0.119-dev1.0, <=9.0.6-ytlc7.5) potentially affected by CVE-2026-25244 via @wdio/browserstack-service (>=9.12.7, <=9.23.0)

@wdio/browserstack-service NPM version =9.12.7, =11.0.0, =7.0.119-dev1.0, =9.0.6-ytlc7.5 Source cves: CVE-2026-25244 Source advisory: SNYK:JS-WDIOBROWSERSTACKSERVICE-16642116...

@elliemae/pui-e2e-test-sdk (>=11.0.0, <=12.4.4), froth-webdriverio-framework (>=7.0.119-dev1.0, <=9.0.6-ytlc7.5) potentially affected by CVE-2026-25244 via @wdio/browserstack-service (>=9.12.7, <=9.23.0)

@wdio/browserstack-service NPM version =9.12.7, =11.0.0, =7.0.119-dev1.0, =9.0.6-ytlc7.5 Source cves: CVE-2026-25244 Source advisory: OSV:GHSA-5C46-X3QW-Q7J7...

PT-2026-39872

Name of the Vulnerable Software and Affected Versions WebdriverIO versions prior to 9.24.0 Description A command injection issue exists in the test orchestration of WebdriverIO, specifically within the @wdio/browserstack-service module. The function getGitMetadataForAISelection interpolates git...