PT-2026-45857 · Browserstack · Browserstack-Runner
CVSS v3.1
8.8
High
| Vector | AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
BrowserStack Runner versions prior to 0.9.6
Description
An issue in the
/ log HTTP handler allows unauthenticated network-adjacent attackers to execute arbitrary code on the host system. The handler processes JSON request bodies by passing user-supplied data to the vm.runInNewContext() function combined with eval(). Because the vm module is not a security mechanism, attackers can escape the Node.js sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor. This allows for full remote code execution on the underlying system. The / log endpoint is particularly susceptible as it does not require the UUID authentication used by other handlers like progress and report.Recommendations
For versions prior to 0.9.6, remove the use of
eval() and vm.runInNewContext() in the / log handler and replace them with JSON.stringify() for safe logging.
Implement UUID authentication for the / log handler to match the security level of the progress and report handlers.
Configure the HTTP server to bind to 127.0.0.1 instead of 0.0.0.0 to restrict network access.
As a temporary mitigation, restrict network access to the / log endpoint.Exploit
Fix
RCE
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Browserstack-Runner