Read the docs

browserstack

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

browserstack records in CISA KEV

No browserstack vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Browserstack-local 1 record LOW

Records

4 records

TI-2026-36356 CVE-2026-49143 · GHSA-6vr3-7wcx-v5g5

BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler

Priority HIGH 73

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON reque…

CVSS 4.0HIGH 8.7 Adjacent network No auth No interaction EPSS 0.00802 Published 2026-06-02 No fix listed CWE-94
TI-2026-36003 CVE-2026-48723

OS command injection in browserstack-cypress-cli

Priority HIGH 69

The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00533 Published 2026-06-15 Fixed in 1.36.6 CWE-78
TI-2026-36357 CVE-2026-49144 · GHSA-8rpw-6cqh-2v9h

BrowserStack Runner 0.9.5 Path Traversal via _default HTTP Handler

Priority MEDIUM 64

BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files.

CVSS 4.0HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00418 Published 2026-06-02 No fix listed CWE-22
Open these records in search →