browserstack has 3 CVEs on record. The median CVSS is 7.8 (high). Most affected products: browserstack-runner (2), browserstack-local (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- —
- Last 90 days
- 0 prev 2
Worst active — by depth score
CVE-2026-49143High· 8.8BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the …61CVE-2026-49144Medium· 6.5BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files48CVE-2025-57283High· 7.8The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability43
browserstack vulnerabilities
CVEs affecting browserstack, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-49144Medium· 6.5PoCBrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files
BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthentic…
CVE-2026-49143High· 8.8PoCBrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the …
BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the …
CVE-2025-57283High· 7.8The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability
The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js.