CVE-2026-49143

Name of the Vulnerable Software and Affected Versions BrowserStack Runner versions prior to 0.9.6

Description An issue in the / log HTTP handler allows unauthenticated network-adjacent attackers to execute arbitrary code on the host system. The handler processes JSON request bodies by passing user-supplied data to the vm.runInNewContext() function combined with eval(). Because the vm module is not a security mechanism, attackers can escape the Node.js sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor. This allows for full remote code execution on the underlying system. The / log endpoint is particularly susceptible as it does not require the UUID authentication used by other handlers like progress and report.

Recommendations For versions prior to 0.9.6, remove the use of eval() and vm.runInNewContext() in the / log handler and replace them with JSON.stringify() for safe logging. Implement UUID authentication for the / log handler to match the security level of the progress and report handlers. Configure the HTTP server to bind to 127.0.0.1 instead of 0.0.0.0 to restrict network access. As a temporary mitigation, restrict network access to the / log endpoint.