CVE-2026-48723

Name of the Vulnerable Software and Affected Versions browserstack-cypress-cli versions prior to 1.36.4

Description The browserstack-cypress-cli allows users to run Cypress tests on BrowserStack. An OS command injection is possible through the cypress config file configuration parameter. In the file readCypressConfigUtil.js, the loadJsFile() function creates a shell command by interpolating the user-controlled cypress config filepath value into a template literal and executes it using child process.execSync(). The use of shell metacharacters, specifically " and ;, enables an attacker to break out of the quoted argument and execute arbitrary commands.

Recommendations Update to version 1.36.6. As a temporary workaround, avoid using untrusted values in the cypress config file parameter.