Which versions of BrowserStack Runner are affected by CVE-2026-49144?

BrowserStack Runner versions through 0.9.5 contain an unauthenticated file disclosure vulnerability that allows network-adjacent attackers to steal source code, credentials, and environment files…

Is there a public PoC exploit available for CVE-2026-49144?

Yes, a public proof-of-concept exploit is available for CVE-2026-49144. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-49144?

24 hours: Inventory all BrowserStack Runner installations, identify versions, and restrict test server access to trusted networks only. 7 days: Audit access logs for unauthorized attempts, rotate any exposed credentials, and assess impact of potential file disclosures. 30 days: Monitor for vendor patch availability; implement permanent network controls or evaluate alternative testing tools if patch timeline is unacceptable.

BrowserStack Runner CVE-2026-49144

Q: What is the CVSS score of CVE-2026-49144?

CVE-2026-49144 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34031 HIGH

Path Traversal (CWE-22)

2026-06-02 VulnCheck

GHSA-8rpw-6cqh-2v9h

Path Traversal Browserstack Runner

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 02, 2026 - 21:28 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 02, 2026 - 21:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 02, 2026 - 21:22 vuln.today

cvss_changed

Severity Changed

Jun 02, 2026 - 21:22 NVD

MEDIUM HIGH

CVSS changed

Jun 02, 2026 - 21:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

Analysis Generated

Jun 02, 2026 - 21:20 vuln.today

DescriptionCVE.org

BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside the project root and access sensitive files.

AnalysisAI

Arbitrary file disclosure in BrowserStack Runner versions through 0.9.5 allows unauthenticated network-adjacent attackers to read sensitive files outside the project root by abusing a path traversal flaw in the default HTTP handler of lib/server.js. Because the embedded test server binds on all interfaces by default, any attacker on the same network segment (Wi-Fi, VLAN, or shared LAN) can retrieve source code, credentials, or environment files. No public exploit identified at time of analysis, but a GitHub Security Advisory (GHSA-8rpw-6cqh-2v9h) has been published.

Technical ContextAI

BrowserStack Runner is a Node.js command-line tool that executes JavaScript unit tests against BrowserStack's cloud browser grid; during a test run it spawns a local HTTP server (lib/server.js) to host the test harness and assets so remote browsers can fetch them. The vulnerability is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) in the server's _default handler, which fails to canonicalize or constrain user-supplied request paths before resolving them against the project root, so sequences such as ../../ escape the intended document root. The CPE cpe:2.3:a:browserstack:browserstack-runner identifies the vulnerable application, and the bug is amplified by the server binding to 0.0.0.0 instead of localhost, exposing it to anyone on the same broadcast domain.

RemediationAI

Upgrade to the patched release published by BrowserStack as referenced in GHSA-8rpw-6cqh-2v9h; the advisory data confirms a fix is available upstream but a specific fixed release version is not independently confirmed in the supplied intelligence, so consult the advisory directly for the exact tag. As compensating controls until the upgrade lands, only run BrowserStack Runner on trusted networks (wired corporate segments rather than shared Wi-Fi), bind the test server to the loopback interface or block inbound traffic to its port with a host firewall, run tests inside an isolated VM or container so the file system reachable from process root contains no secrets, and rotate any credentials that may have lived in the project tree during prior test runs.