EUVD-2026-34031
GHSA-8rpw-6cqh-2v9h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessJoin shared LAN/Wi-Fi as developer
-
DeliveryScan for BrowserStack Runner HTTP port
-
ExploitSend GET with ../ traversal sequence
-
Execution_default handler reads file outside project root
-
ImpactExfiltrate credentials, source, and dotfiles
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a victim actively running BrowserStack Runner ≤ 0.9.5, since the vulnerable HTTP server only listens during a test execution window, (2) network-adjacent reachability to the host - the CVSS AV:A and the description's 'bound on all interfaces' together mean same-LAN/VLAN/Wi-Fi reachability is sufficient but routed Internet access is not, and (3) the attacker knowing or scanning for the ephemeral listening port. Limiting factors: the process must be live (transient exposure tied to test runs), the attacker must share a broadcast domain or be otherwise routable to the developer's host, and impact is bounded by the file system permissions of the user running the Node.js process. No authentication and no user interaction on the victim side are needed once those conditions hold. |
| Impact | The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) scores 7.1 and accurately captures the real risk: adjacent-network attack vector, low complexity, no privileges or user interaction required, and high confidentiality impact with no integrity or availability consequences. There is no EPSS score, no KEV listing, and no public POC supplied in the intelligence package, so this is not a mass-exploitation candidate; however, the prerequisites are weak (any colleague on the same office or coffee-shop Wi-Fi during a test run can read arbitrary files), which raises the practical risk for developers who run the tool on laptops in untrusted networks. The signals are internally consistent - adjacent vector matches the bound-on-all-interfaces description - and the primary uncertainty is the lifetime of exposure, since the server only runs while tests execute. |
| Exploit ScenarioDerived | While a developer runs BrowserStack Runner on a corporate laptop connected to guest Wi-Fi, an attacker on the same subnet scans for the listening test server port and sends a crafted HTTP GET such as /../../../../Users/dev/.aws/credentials, which the _default handler resolves outside the project root and returns. The attacker harvests cloud keys, SSH private keys, and source files in seconds; no authentication, user interaction, or public exploit code is required because the traversal pattern is trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 02, 2026
Arbitrary file disclosure in BrowserStack Runner versions through 0.9.5 allows unauthenticated network-adjacent attackers to read sensitive files outside the project root by abusing a path traversal flaw in the default HTTP handler of lib/server.js. Because the embedded test server binds on all interfaces by default, any attacker on the same network segment (Wi-Fi, VLAN, or shared LAN) can retrieve source code, credentials, or environment files. No public exploit identified at time of analysis, but a GitHub Security Advisory (GHSA-8rpw-6cqh-2v9h) has been published.
Earlier versions of this analysis (2)
Arbitrary file read in BrowserStack Runner through version 0.9.5 allows network-adjacent unauthenticated attackers to retrieve sensitive files from the developer's host via path traversal in the bundled HTTP server. The flaw resides in the _default handler in lib/server.js, which binds on all interfaces and fails to constrain requests to the project root. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Path traversal in BrowserStack Runner through 0.9.5 exposes arbitrary files to unauthenticated network-adjacent attackers via the _default HTTP handler in lib/server.js. The embedded HTTP server binds on all network interfaces without authentication, allowing any host on the same network segment to traverse outside the project root directory and read sensitive files. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make exploitation straightforward for any local network attacker.
RemediationAI
Upgrade to the patched release published by BrowserStack as referenced in GHSA-8rpw-6cqh-2v9h; the advisory data confirms a fix is available upstream but a specific fixed release version is not independently confirmed in the supplied intelligence, so consult the advisory directly for the exact tag. As compensating controls until the upgrade lands, only run BrowserStack Runner on trusted networks (wired corporate segments rather than shared Wi-Fi), bind the test server to the loopback interface or block inbound traffic to its port with a host firewall, run tests inside an isolated VM or container so the file system reachable from process root contains no secrets, and rotate any credentials that may have lived in the project tree during prior test runs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
BrowserStack Runner is a Node.js command-line tool that executes JavaScript unit tests against BrowserStack's cloud browser grid; during a test run it spawns a local HTTP server (lib/server.js) to host the test harness and assets so remote browsers can fetch them. The vulnerability is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) in the server's _default handler, which fails to canonicalize or constrain user-supplied request paths before resolving them against the project root, so sequences such as ../../ escape the intended document root. The CPE cpe:2.3:a:browserstack:browserstack-runner identifies the vulnerable application, and the bug is amplified by the server binding to 0.0.0.0 instead of localhost, exposing it to anyone on the same broadcast domain.
Know when Browserstack Runner gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside the project root and access sensitive files.
Executive ViewAI
BrowserStack Runner versions through 0.9.5 contain an unauthenticated file disclosure vulnerability that allows network-adjacent attackers to steal source code, credentials, and environment files from systems using this tool. Organizations face immediate credential compromise and intellectual property theft risks, with no vendor patch currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: implement network segmentation to restrict test server access, configure firewall blocking external connections to default HTTP interface, disable default HTTP binding in favor of TLS-protected endpoints with authentication, and isolate BrowserStack Runner instances to air-gapped development networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB