CVE-2026-49144
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside the project root and access sensitive files.
Risk Assessment
Path traversal vulnerability could allow an attacker to read sensitive system files such as configurations, passwords, or application data, potentially leading to security breaches.
Recommendation
Update BrowserStack Runner to a version above 0.9.5. Restrict access to the HTTP server to trusted networks and implement path validation.
Other vulnerabilities in BrowserStack Runner
Original NVD description (English source)
BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside the project root and access sensitive files.