Skip to content
OpenAdvisories

Vendor

browserstack

3 known vulnerabilities.

Products

browserstack-runner 2 browserstack-cypress-cli 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.8
    CVE-2026-48723

    BrowserStack Cypress CL: Command Injection via cypress_config_file leads to arbitrary code execution through malicious browserstack.json

    The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via the cypress_config_file configuration parameter. In readCypressConfigUtil.js, the l…

    browserstack browserstack-cypress-cli
  • High 8.8
    CVE-2026-49143

    BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler

    BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes …

    browserstack browserstack-runner browserstack-runner npm