Read the docs
TI-2026-36356 Aliases CVE-2026-49143GHSA-6vr3-7wcx-v5g5

BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler

Priority HIGH 73CWE-94Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00802 56th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
browserstackbrowserstack-runnerup to 0.9.5—No fix listedCNA
—browserstack-runner (npm)up to 0.9.5—No fix listedGHSA-6vr3-7wcx-v5g5
  • browserstack-runner Vendorbrowserstack Affected up to 0.9.5 Fixed in — No fix listed CNA
  • browserstack-runner (npm) Vendor— Affected up to 0.9.5 Fixed in — No fix listed GHSA-6vr3-7wcx-v5g5

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49143
  2. 2026-10-03 Alias added: GHSA-6vr3-7wcx-v5g5

References

Advisory 2

Other 1

  • TI-2026-36003 OS command injection in browserstack-cypress-cli CVSS 3.1HIGH 7.8
  • TI-2026-36357 BrowserStack Runner 0.9.5 Path Traversal via _default HTTP Handler CVSS 4.0HIGH 7.1
  • TI-2025-35496 The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences