PT-2026-6418 · Npm · Browserstack-Local

Publicado 2026-01-28 · Atualizado 2026-01-28

OSV

CVSS v4.0

6.6

Média

Vetor base

AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

GHSA-G4W6-C99W-4WH7

Produtos afetados

Browserstack-Local

Referências · 6

• https://github.com/browserstack/browserstack-local-nodejs · Nota
• https://github.com/browserstack/browserstack-local-nodejs/issues/168 · Nota
• https://gist.github.com/Dremig/b639c61541dd1482007dc7a5cd7fefb1 · Nota
• https://osv.dev/vulnerability/GHSA-g4w6-c99w-4wh7 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-57283 · Nota de Segurança
• https://npmjs.com · Nota