CVE-2026-49143

HighCVSS 8.8

Published: 02/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

32th percentile - higher than 32% of all known CVEs

Summary

BrowserStack Runner through version 0.9.5 has a remote code execution vulnerability in the /_log HTTP handler. An unauthenticated network-adjacent attacker can submit crafted JSON requests that are passed to vm.runInNewContext() with eval(), allowing escape from the Node.js sandbox and full remote code execution.

Risk Assessment

An attacker can gain full system control without authentication, posing a critical threat to confidentiality, integrity, and availability.

Recommendation

Immediately upgrade BrowserStack Runner to a version later than 0.9.5 or apply available security patches.

Other vulnerabilities in BrowserStack Runner

CVE-2026-49144Medium
BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside the project root and access sensitive files.

Original NVD description (English source)

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication.