Executive brief
The BrowserStack Cypress CLI, a tool used by developers to run automated web tests, is vulnerable to a security flaw that allows for unauthorized command execution. If a developer or automated system runs the tool within a directory containing a specially crafted configuration file (browserstack.json), an attacker could gain full control over the machine. This could lead to the theft of sensitive source code, credentials, or the compromise of software build pipelines.
Technical details
An OS command injection vulnerability exists in browserstack-cypress-cli versions prior to 1.36.4. The vulnerability is located in the loadJsFile() function within readCypressConfigUtil.js, which uses child_process.execSync() to execute a command constructed via string interpolation of the user-provided cypress_config_filepath. Because the input is not properly sanitized, an attacker can use shell metacharacters (such as double quotes and semicolons) to break out of the intended command string and execute arbitrary shell commands. Exploitation typically occurs when a victim clones a malicious repository and executes the 'run' command. The issue was addressed in version 1.36.4 (and further refined in 1.36.6) by replacing execSync with execFileSync and adding path validation.
Affected products
- BrowserStack browserstack-cypress-cli < 1.36.4
Timeline
- 2026-04-16: patched: Fix committed to repository
- 2026-05-22: advisory: GitHub Security Advisory published
- 2026-06-15: disclosed: CVE published to NVD