CVE-2026-49143

The record

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication.

Affected packages

Related vulnerabilities

• GHSA-6vr3-7wcx-v5g5 browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log… Same vulnerability
• GHSA-8rpw-6cqh-2v9h browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP… Also affects browserstack-runner
• CVE-2026-49144 BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default… Also affects browserstack-runner
• CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94
• CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-94
• CVE-2026-112100 A vulnerability was determined in DeepPavlov up to 1.7.0. CWE-94
• CVE-2026-112095 A flaw has been found in SourceCodester Inventory System 1.0. CWE-94
• CVE-2026-112042 A security flaw has been discovered in diem-project diem up to… CWE-94