CVE-2026-48723: BrowserStack Cypress CLI Command Injection Vulnerability (CVSS 7.8)

Technical summary

CVE-2026-48723 is an OS command injection vulnerability in browserstack-cypress-cli versions prior to 1.36.6. The readCypressConfigUtil.js file's loadJsFile() function constructs a shell command by directly interpolating the user-controlled cypress_config_filepath parameter into a template literal without proper escaping, then executes it via child_process.execSync(). The vulnerability allows an attacker to inject shell metacharacters—particularly double quotes and semicolons—to break out of the quoted argument context and execute arbitrary shell commands. This is a classic command injection pattern where user input flows directly into shell execution without sanitization. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Business impact

Successful exploitation allows attackers to execute arbitrary commands on machines running browserstack-cypress-cli, potentially leading to data exfiltration, system compromise, or lateral movement within development and CI/CD environments. Given that this tool is typically used in automated testing pipelines, compromise could affect the integrity of test data, build artifacts, and deployment systems. The impact extends beyond individual developers to any organization using this CLI in shared or CI/CD infrastructure, where a single compromised configuration file could affect multiple team members or automated workflows.

Affected systems

BrowserStack's Cypress CLI (browserstack-cypress-cli) versions prior to 1.36.6 are vulnerable. Organizations using this tool for running Cypress tests on BrowserStack's cloud testing infrastructure are affected. The vulnerability is particularly relevant for teams using this CLI in local development environments, CI/CD pipelines (Jenkins, GitHub Actions, GitLab CI, etc.), or shared testing infrastructure.

Exploitability

Exploitability requires local access and user interaction—an attacker must supply a malicious cypress_config_filepath value, either by modifying configuration files or convincing a user to use a crafted config path. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates low attack complexity and no privilege requirement, but does require user interaction. In automated pipelines, if an attacker can control the config parameter (through a compromised repository, dependency, or configuration management system), exploitation becomes more straightforward without relying on direct user interaction. The vulnerability is not currently tracked in CISA's KEV catalog.

Remediation

Immediately upgrade browserstack-cypress-cli to version 1.36.6 or later. This patched version addresses the command injection by properly handling the cypress_config_filepath parameter without exposing it to shell interpretation. Organizations should prioritize this update in development and CI/CD environments where this tool is actively used. Verify the upgrade completes successfully and that Cypress tests continue to execute normally before rolling back any workarounds.

Patch guidance

Upgrade browserstack-cypress-cli to version 1.36.6 or later. For npm-based installations, run 'npm install -g browserstack-cypress-cli@latest' or update your package.json dependency and reinstall. For project-specific installations, update the package dependency to >=1.36.6 and run 'npm install'. Verify the installed version with 'browserstack-cypress-cli --version' and confirm that your existing Cypress test runs complete successfully before assuming remediation is complete. Test against your current cypress.config.js files to ensure no breaking changes in behavior.

Detection guidance

Monitor for command injection attempts in logs by searching for suspicious shell metacharacters (quotes, semicolons, pipes, ampersands) in cypress_config_filepath parameters passed to browserstack-cypress-cli. In CI/CD environments, audit pipeline configuration files and environment variables for unusual characters in config file path specifications. Review recent changes to browserstack configuration in version control systems. Check system process logs for unexpected child processes spawned by the CLI tool. Organizations can scan their dependencies using software composition analysis (SCA) tools configured to flag browserstack-cypress-cli versions <1.36.6.

Why prioritize this

This vulnerability merits immediate attention despite not being in active exploitation (KEV status: false). The combination of local access requirement with low attack complexity and high impact (confidentiality, integrity, and availability) makes it a meaningful risk in development and CI/CD contexts. Organizations using browserstack-cypress-cli should treat this as a high-priority patch, particularly if the tool is integrated into automated build pipelines where configuration parameters may be externally influenced. The fix is straightforward and low-risk, making remediation efficiently achievable.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects the vulnerability's local attack vector, low attack complexity, and lack of privilege requirements, combined with high impact across confidentiality, integrity, and availability. The 'User Interaction Required' component (UI:R) acknowledges that someone must trigger the vulnerable code path with a malicious config parameter, preventing a critical rating. However, in automated CI/CD contexts where config parameters may be externally sourced or modified, the user interaction barrier is reduced in practical scenarios. The severity justifies rapid patching and heightened monitoring during transition periods.

Frequently asked questions