Executive brief
BrowserStack Runner, a tool used by developers to run automated tests across different browsers, contains a vulnerability that allows an attacker on the same network to execute commands on the developer's computer. By sending a specially crafted request to the tool's logging endpoint, an attacker can bypass security restrictions and gain full control over the host system. This could lead to the theft of sensitive BrowserStack access keys or other private data stored on the machine.
Technical details
The browserstack-runner package (versions <= 0.9.5) contains a remote code execution vulnerability in its internal HTTP server, which by default listens on all interfaces (0.0.0.0) on port 8888. The '/_log' endpoint in 'lib/server.js' fails to implement authentication and passes unauthenticated POST request data directly into a Node.js 'vm.runInNewContext()' call combined with 'eval()'. Because the 'vm' context includes a reference to 'util.format', an attacker can escape the sandbox using standard Node.js constructor-chaining techniques to access the host 'process' object. This allows for arbitrary command execution (e.g., via 'child_process.execSync') and access to environment variables like BrowserStack credentials. No patch is currently available; users are advised to bind the server to localhost or implement network-level access controls.
Affected products
- BrowserStack browserstack-runner <= 0.9.5
Timeline
- 2026-05-27: disclosed: Initial disclosure in GitHub Advisory Database
- 2026-06-02: advisory: NVD publication date
- 2026-06-03: advisory: GitHub Advisory reviewed and updated