Executive brief
A security vulnerability exists in the BrowserStack Local Node.js package, which is used to establish secure connections between local development environments and BrowserStack's testing cloud. An attacker with local access to a system could execute unauthorized commands by providing a specially crafted log file path. This could lead to a full system compromise, unauthorized data access, or disruption of testing operations.
Technical details
A command injection vulnerability (CWE-78) exists in browserstack-local version 1.5.8 within the `lib/Local.js` component. The vulnerability stems from the application failing to properly sanitize the `logfile` variable before using it in a system command context. An attacker with local privileges can exploit this by supplying a malicious string containing shell metacharacters (e.g., semicolons) to the `logfile` parameter, leading to arbitrary code execution with the privileges of the Node.js process. While no official patch is noted in the advisory, Red Hat recommends implementing strict allow-list validation for the logfile path to mitigate the risk.
Affected products
- BrowserStack browserstack-local 1.5.8
- Red Hat Red Hat Fuse 7 7
Timeline
- 2025-09-05: disclosed: Initial discovery and PoC created by Dremig
- 2026-01-28: advisory: CVE published and Red Hat advisory issued