CVE-2026-49143: BrowserStack Runner Remote Code Execution (CVSS 8.8)

Technical summary

The vulnerability exists in the /_log HTTP endpoint, which accepts JSON payloads and passes unsanitized user input directly to vm.runInNewContext() combined with eval(). This creates a code injection vector. More critically, attackers can leverage util.format and prototype chain manipulation (this.constructor.constructor) to obtain a reference to the host Function constructor, bypassing the intended Node.js vm sandbox isolation. This grants access to the host process context and enables unrestricted remote code execution with the privileges of the BrowserStack Runner process.

Business impact

Successful exploitation allows complete compromise of systems running BrowserStack Runner. Attackers can read sensitive data, modify test configurations, inject malicious code into build pipelines, or pivot to other infrastructure. Organizations using BrowserStack Runner in CI/CD environments face particular risk, as compromised runners could inject malicious artifacts into production builds or exfiltrate source code and credentials stored in the environment.

Affected systems

BrowserStack Runner version 0.9.5 and earlier are affected. Verify your installed version against the vendor advisory to confirm exposure. The vulnerability requires network adjacency but no authentication, making it exploitable by any attacker with local network access to the affected host.

Exploitability

The attack is straightforward to execute: an attacker crafts a malicious JSON payload targeting the /_log handler and sends it over HTTP from the local network. No authentication is required, and the resulting code execution is immediate and unrestricted. The low complexity and accessibility of the attack vector elevate practical risk despite the network-adjacency requirement.

Remediation

Upgrade BrowserStack Runner to a patched version released after the CVE publication date. Verify the specific patch version against the official vendor advisory. As an interim mitigation, restrict network access to BrowserStack Runner instances using firewall rules or network segmentation to limit exposure to trusted systems only.

Patch guidance

Contact BrowserStack or consult their security advisories for the specific patched version addressing CVE-2026-49143. Apply updates according to your standard change management process. Test updates in a non-production environment first, particularly if BrowserStack Runner is critical to your build pipeline.

Detection guidance

Monitor for HTTP POST requests to the /_log endpoint, especially those originating from unexpected network sources. Look for JSON payloads containing eval-like patterns, constructor chains, or references to Function or prototype manipulation. Endpoint detection and response (EDR) tools should flag suspicious child process spawning from BrowserStack Runner processes, as exploitation typically results in shell execution.

Why prioritize this

This vulnerability scores 8.8 (HIGH) due to high impact (confidentiality, integrity, availability), low attack complexity, and absence of authentication requirements. Although network adjacency is required, organizations with BrowserStack Runner exposed to broader networks face meaningful risk. The presence in active CI/CD pipelines amplifies business criticality. Prioritize patching systems in production or DMZ environments.

Risk score, explained

CVSS 3.1 score of 8.8 reflects: Attack Vector (Adjacent Network) — reduces from 9.9 if remotely exploitable but remains serious; Attack Complexity (Low) — trivial to execute; Privileges Required (None) — no credentials needed; User Interaction (None) — automatic exploitation; Scope (Unchanged) — impact limited to the affected system; Confidentiality/Integrity/Availability (High) — complete system compromise. The absence of KEV status and exploit prevalence data does not diminish the practical severity; organizations should treat this as urgent.

Frequently asked questions