CVE-2026-49143
HIGH
MEDIUM
Priority: 0.07
BB Relevance:
63/100
Published: 2026-06-02
Modified: 2026-11-08
First seen: 2026-11-08
Status: active
Attack Surface
Adjacent
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Adjacent
AC:
Low
PR:
None
UI:
None
AT:
None
VC:
High
VI:
High
VA:
High
Description
BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| browserstack | browserstack-runner | 0 |
References & Advisories (2)
vendor-advisory
third-party-advisory