BrowserStack Runner CVE-2026-49143

The victim must be running BrowserStack Runner 0.9.5 or earlier with its local HTTP server listening on a network interface reachable to the attacker - the CVSS AV:A constraint means the attacker must be on the same Layer-2 / adjacent network segment (same VLAN, Wi-Fi, or virtual subnet), not arbitrary internet routes. No authentication, no user interaction, and no special configuration toggles are required: the vulnerable /_log handler and its vm.runInNewContext()+eval() code path are present in the default runtime. Exploitation is limited where the runner is bound to 127.0.0.1 only, where a host firewall blocks the listening port from non-loopback sources, or where the host is on an isolated developer network with no untrusted peers.

The CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates adjacent-network reachability, low complexity, no authentication, no user interaction, and full CIA impact - a serious profile mitigated only by the AV:A (adjacent) scope, meaning the attacker must be on the same broadcast/L2 segment or able to reach the local listening port. EPSS, KEV status, and SSVC decision data were not provided in the input, so probabilistic exploitation likelihood and CISA prioritization signals cannot be cross-referenced. No public exploit identified at time of analysis, but the underlying vm-sandbox-escape pattern (this.constructor.constructor) is extremely well-known in the Node.js security community, so weaponization difficulty is low for any motivated attacker. Real-world risk is highest in shared developer environments, CI runners, and corporate LANs where the BrowserStack Runner port is reachable from coworker or guest networks; risk is lower for individual developers running it bound to localhost only - though the CVSS AV:A rating suggests the maintainers consider non-loopback exposure realistic.

An attacker on the same office LAN, coffee-shop Wi-Fi, or co-tenant cloud subnet as a developer running BrowserStack Runner sends a single crafted POST to the /_log endpoint with a JSON payload designed to traverse this.constructor.constructor via util.format. The payload escapes the Node.js vm sandbox and executes arbitrary commands as the developer's user, allowing the attacker to exfiltrate source code, SSH keys, cloud credentials, and BrowserStack API tokens from the host. No public exploit identified at time of analysis, but the sandbox-escape primitive is well-documented and requires only basic Node.js knowledge to weaponize.