Browserstack Runner
Approved changes feed: RSS · Atom
cpe:2.3:a:browserstack:browserstack-runner:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Browserstack (61f1b856-39d3-5f2c-879b-2c45035d78e4) |
|---|---|
| Product | Browserstack Runner (c921ef66-532e-5deb-b501-6e7d1a7a9088) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-49144 |
vulnerable | 2026-06-08 08:05:12.416113 |
BrowserStack Runner 0.9.5 Path Traversal via _default HTTP Handler
MEDIUM (6.5)
BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside the project root and access sensitive files.
Published: 2026-06-02T20:34:54.748Z
Updated: 2026-08-14T16:50:03.826Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-49143 |
vulnerable | 2026-06-08 08:05:12.415894 |
BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler
HIGH (8.8)
BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication.
Published: 2026-06-02T20:31:16.903Z
Updated: 2026-08-14T16:50:03.154Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.