CVE-2026-48723: BrowserStack Cypress CLI RCE Vulnerability

CVE-2026-48723 Overview

CVE-2026-48723 is an OS command injection vulnerability [CWE-78] in the browserstack-cypress-cli package, BrowserStack's command-line interface for running Cypress tests on the BrowserStack platform. Versions prior to 1.36.4 interpolate the user-controlled cypress_config_filepath value into a shell command, then execute it via child_process.execSync(). An attacker who controls the configuration file path can inject arbitrary shell commands using metacharacters such as " and ;. The issue is fixed in version 1.36.6.

Critical Impact
Arbitrary OS command execution in the context of the user running the CLI, leading to full compromise of confidentiality, integrity, and availability on the host.

Affected Products

browserstack-cypress-cli versions prior to 1.36.4
Node.js environments and CI/CD pipelines invoking the vulnerable CLI
Developer workstations executing Cypress tests via BrowserStack

Discovery Timeline

2026-06-15 - CVE-2026-48723 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-48723

Vulnerability Analysis

The vulnerability resides in bin/helpers/readCypressConfigUtil.js. The loadJsFile() function builds a shell command by interpolating the cypress_config_filepath value into a template literal, then passes the resulting string to child_process.execSync(). Because execSync spawns a shell, any unescaped shell metacharacter in the path is interpreted by /bin/sh rather than treated as part of a filename.

An attacker who can influence the cypress_config_file configuration parameter, for example through a malicious project checkout, a poisoned configuration file, or a supply-chain compromise, can supply a path containing " to break out of the quoted argument and ; to chain arbitrary commands. The injected commands execute with the privileges of the user running the CLI, which in CI/CD environments often includes access to source code, secrets, and build artifacts.

Root Cause

The root cause is unsafe construction of a shell command from untrusted input. The code relies on quoting the file path inside a template literal rather than passing arguments as a separate array to a non-shell API such as execFileSync. No validation or sanitization is performed on the path before it reaches the shell.

Attack Vector

Exploitation requires local access and user interaction, typically the act of running browserstack-cypress against a project whose configuration references a maliciously crafted path. Common delivery vectors include cloned repositories, pull requests modifying browserstack.json, or compromised dependencies that influence the configuration.

javascript

// Patch from bin/helpers/readCypressConfigUtil.js
// Defense-in-depth: reject file paths containing shell metacharacters.
// This guards against command injection even if execFileSync is ever
// replaced with a shell-based exec in the future.
const DANGEROUS_PATH_CHARS = /[;"`$|&(){}\\]/;

function validateFilePath(filepath) {
    if (DANGEROUS_PATH_CHARS.test(filepath)) {
        throw new Error(
            `Invalid cypress config file path: "${filepath}" contains disallowed characters. ` +
            'File paths must not include shell metacharacters such as ; " ` $ | & ( ) { } \\'
        );
    }
}

exports.validateFilePath = validateFilePath;

Source: GitHub commit 6dbf8f9

Detection Methods for CVE-2026-48723

Indicators of Compromise

Unexpected child processes spawned by node running browserstack-cypress or readCypressConfigUtil.js.
Shell processes (/bin/sh -c) launched with command strings containing cypress_config_file values that include ", ;, |, `, or $().
Outbound network connections from CI runners or developer hosts initiated during browserstack-cypress invocations.
browserstack.json or pipeline configuration files referencing config paths with embedded shell metacharacters.

Detection Strategies

Inventory installed versions of browserstack-cypress-cli across developer workstations and CI/CD agents and flag anything below 1.36.6.
Monitor process-creation telemetry for node parent processes spawning sh, bash, curl, wget, or nc during Cypress test runs.
Scan repositories and pipeline definitions for cypress_config_file entries containing characters outside a strict filename allowlist.

Monitoring Recommendations

Enable process command-line logging on build agents and ingest it into your detection pipeline.
Alert on new or anomalous outbound connections from CI workers during test execution windows.
Track changes to browserstack.json and related configuration files via source-control auditing.

How to Mitigate CVE-2026-48723

Immediate Actions Required

Upgrade browserstack-cypress-cli to version 1.36.6 or later in all projects, lockfiles, and CI/CD images.
Audit recent CI/CD runs and developer hosts for the indicators listed above and rotate any secrets that may have been exposed.
Restrict who can modify browserstack.json and related configuration through code-review and branch-protection policies.

Patch Information

The fix is delivered in browserstack-cypress-cli1.36.6. The patch introduces a validateFilePath() function that rejects paths containing ;, ", `, $, |, &, (, ), {, }, and \, and removes the unsafe shell-based execution pattern. Full details are available in the GitHub Security Advisory GHSA-fh4c-mffm-8xhf and the upstream commit.

Workarounds

Pin cypress_config_file to a known, static path controlled by the repository owner and reject pull requests that modify it.
Run browserstack-cypress inside ephemeral, least-privilege containers without access to long-lived secrets.
Pre-validate configuration values against a strict allowlist (for example, ^[A-Za-z0-9_./-]+$) before invoking the CLI.

bash

# Upgrade to the patched version
npm install --save-dev browserstack-cypress-cli@1.36.6

# Verify the installed version
npx browserstack-cypress --version

# Optional pre-flight validation in CI
grep -E '"cypress_config_file"\s*:\s*"[^"]*[;"`$|&(){}\\][^"]*"' browserstack.json \
  && { echo "Unsafe cypress_config_file value"; exit 1; } || true