{"uuid": "4f804da5-c6db-45f4-8b4a-a03d92c7da14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-6vr3-7wcx-v5g5", "type": "seen", "source": "https://gist.github.com/alon710/0a4fd57da163f29a224f9f12ea16fb50", "content": "# CVE-2026-49143: CVE-2026-49143: Unauthenticated Remote Code Execution in browserstack-runner\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-06-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-49143\n\n## Summary\nAn unauthenticated remote code execution (RCE) vulnerability exists in the browserstack-runner npm package (versions up to and including 0.9.5). The flaw lies in the /_log HTTP endpoint handler, which evaluates user-supplied input within a non-secure Node.js VM context combined with dynamic eval() execution. Network-adjacent attackers can exploit this behavior to escape the sandbox and execute arbitrary system commands on the host machine.\n\n## TL;DR\nUnauthenticated remote code execution vulnerability in browserstack-runner <= 0.9.5 via a sandbox escape in the /_log HTTP handler.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94: Improper Control of Generation of Code ('Code Injection')\n- **Attack Vector**: Adjacent Network\n- **CVSS v3.1 Score**: 8.8\n- **CVSS v4.0 Score**: 8.7\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n- **Impact**: High (Complete Confidentiality, Integrity, and Availability Loss)\n\n## Affected Systems\n\n- Workstations running browserstack-runner configurations locally\n- Continuous integration (CI/CD) runners executing automated cross-browser suites\n- Local development servers utilizing browserstack-runner <= 0.9.5\n- **browserstack-runner**: <= 0.9.5\n\n## Mitigation\n\n- Avoid using Node.js standard vm modules or eval() routines to parse user-controlled input.\n- Restrict HTTP listener bindings in lib/server.js to 127.0.0.1 instead of 0.0.0.0 to prevent adjacent network access.\n- Introduce token-based session validation checks on the /_log endpoint to reject unauthenticated requests.\n\n**Remediation Steps:**\n1. Open the file lib/server.js within the browserstack-runner installation directory.\n2. Locate the route definition mapping to the /_log handler.\n3. Replace the call to vm.runInNewContext() and eval() with a safe mapping function that stringifies or sanitizes arguments.\n4. Modify the HTTP listen configuration to specify host '127.0.0.1' rather than binding to all network interfaces.\n\n## References\n\n- [GitHub Security Advisory (GHSA-6vr3-7wcx-v5g5)](https://github.com/browserstack/browserstack-runner/security/advisories/GHSA-6vr3-7wcx-v5g5)\n- [VulnCheck Advisory Portal](https://www.vulncheck.com/advisories/browserstack-runner-unauthenticated-rce-via-log-http-handler)\n- [NVD Entry for CVE-2026-49143](https://nvd.nist.gov/vuln/detail/CVE-2026-49143)\n- [GitHub Project Repository](https://github.com/browserstack/browserstack-runner)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-49143) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-03T22:40:56.000000Z"}