PT-2026-49536 · Browserstack · Browserstack-Cypress-Cli

Published 2026-06-15 · Updated 2026-06-15 · CVE-2026-48723

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via the cypress config file configuration parameter. In readCypressConfigUtil.js, the loadJsFile() function constructs a shell command by interpolating the user-controlled cypress config filepath value into a template literal, then executes it via child process.execSync(). Shell metacharacters in the config path (specifically " and ;) allow breaking out of the quoted argument and injecting arbitrary commands. This issue has been fixed in version 1.36.6.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-48723

Affected Products

Browserstack-Cypress-Cli

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-48723 · Security Note
• https://github.com/browserstack/browserstack-cypress-cli/commit/6dbf8f9374c0e25eac818fbcb95f5705ded71710 · Note
• https://github.com/browserstack/browserstack-cypress-cli/security/advisories/GHSA-fh4c-mffm-8xhf · Note