Which versions of BrowserStack Runner are affected by CVE-2026-49143?

BrowserStack Runner versions through 0.9.5 contain a remote code execution vulnerability that allows unauthenticated attackers with network access to execute arbitrary code on affected systems.

Is there a public PoC exploit available for CVE-2026-49143?

Yes, a public proof-of-concept exploit is available for CVE-2026-49143. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-49143?

Within 24 hours: Inventory all systems running BrowserStack Runner 0.9.5 and earlier; assess criticality of test workflows dependent on this tool. Within 7 days: Implement network segmentation to isolate BrowserStack Runner instances from production infrastructure; restrict access to authorized internal test networks only; identify alternative browser testing frameworks. Within 30 days: Complete migration away from BrowserStack Runner 0.9.5 or upgrade to patched version once released; verify all vulnerable instances have been decommissioned.

BrowserStack Runner CVE-2026-49143

Q: What is the CVSS score of CVE-2026-49143?

CVE-2026-49143 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-34029 HIGH

Code Injection (CWE-94)

2026-06-02 VulnCheck

GHSA-6vr3-7wcx-v5g5

RCE Node.js Code Injection Browserstack Runner Browserstack

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Jun 02, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

Jun 02, 2026 - 21:22 NVD

8.8 (HIGH) 8.7 (HIGH)

Analysis Generated

Jun 02, 2026 - 21:21 vuln.today

DescriptionCVE.org

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication.

AnalysisAI

Remote code execution in BrowserStack Runner through version 0.9.5 allows network-adjacent unauthenticated attackers to execute arbitrary code on the host system by sending crafted JSON to the /_log HTTP handler. The flaw stems from unsafe use of vm.runInNewContext() combined with eval(), and a known sandbox-escape technique via util.format and this.constructor.constructor enables full host compromise. No public exploit identified at time of analysis, but the technique is well-documented and the CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability.

Technical ContextAI

BrowserStack Runner is a Node.js-based local test runner that bridges JavaScript test suites with the BrowserStack cloud browser grid, exposing a local HTTP server to capture test telemetry. The vulnerability is a classic CWE-94 (Improper Control of Generation of Code) issue: the /_log endpoint passes user-supplied JSON body content into Node.js vm.runInNewContext() and further evaluates it with eval(). Although Node's vm module is frequently mistaken for a security boundary, it is not - by reaching a Function constructor through a host-context object (here via util.format leaking a host reference, then traversing this.constructor.constructor), an attacker can synthesize a function compiled in the outer (host) realm and obtain arbitrary code execution outside the sandbox. The affected CPE is cpe:2.3:a:browserstack:browserstack-runner:*:*:*:*:*:*:*:* covering all versions up to and including 0.9.5.

RemediationAI

Upgrade to a fixed release of BrowserStack Runner as published in GHSA-6vr3-7wcx-v5g5 at https://github.com/browserstack/browserstack-runner/security/advisories/GHSA-6vr3-7wcx-v5g5; a specific fixed version is not explicitly stated in the provided data, so consult the GHSA advisory for the exact patched version (patch available per vendor advisory). Until upgraded, bind the runner's HTTP listener to 127.0.0.1 only rather than 0.0.0.0 or a routable interface to eliminate adjacent-network reachability - this is the highest-value compensating control and has no functional cost for typical local development workflows. Where binding cannot be restricted, use a host-based firewall rule to block inbound traffic to the BrowserStack Runner port from all addresses except loopback, and avoid running BrowserStack Runner on shared CI hosts, jump boxes, or systems on untrusted Wi-Fi/guest VLANs. As a defense-in-depth measure, run the process under a non-privileged service account so post-exploit impact is limited to that user's permissions; note this does not prevent compromise of source code, secrets, or session tokens accessible to that account.