Junglewise Threat Intelligence

CVE-2026-25244: WebdriverIO command injection in BrowserStack service

CVE-2026-25244 · Severity: critical · CVSS 9.8 · Published 2026-05-18

Vendors: npm.

Executive brief

WebdriverIO BrowserStack Service is a testing framework integration used by development teams to automate browser testing on the BrowserStack platform. A critical vulnerability allows attackers to execute arbitrary commands on CI/CD servers or developer machines by providing a malicious git repository with a crafted branch name. This could lead to data theft (secrets, source code, SSH keys), system compromise, or supply chain attacks by modifying build artifacts.

Technical details

The vulnerability is a OS command injection (CWE-78) in the testOrchestrationOptions.runSmartSelection feature. The vulnerable code in helpers.ts line 204 directly interpolates git branch names into execSync() calls without sanitization: `execSync(`git diff --name-only ${baseBranch} .. ${currentBranch}`)`. Since git allows branch names to contain special characters and semicolons, an attacker can craft branches like `main;touch /tmp/pwned.txt;echo PWNED` to break out of the git command context. Attack requires either: (1) attacker-controlled repository specified in testOrchestrationOptions.runSmartSelection.source, or (2) ability to create branches in the current directory's git repository. No authentication or user interaction is required. Fix is available in version 9.24.0.

Affected products

  • webdriverio @wdio/browserstack-service <= 9.23.2

Timeline

  • 2026-05-11: disclosed: Vulnerability published as GHSA-5c46-x3qw-q7j7 and CVE-2026-25244
  • 2026-02-10: patched: Fixed in version 9.24.0

References