CVE-2026-49143 Overview
CVE-2026-49143 is a remote code execution vulnerability in BrowserStack Runner through version 0.9.5. The flaw resides in the /_log HTTP handler, which passes user-supplied JSON data to vm.runInNewContext() combined with eval(). Unauthenticated, network-adjacent attackers can submit crafted JSON request bodies to break out of the Node.js vm sandbox and execute arbitrary code on the host. The escape leverages a host-context Function reference exposed through util.format, reaching the host process via this.constructor.constructor. The weakness is classified as Improper Control of Generation of Code [CWE-94].
Critical Impact
Unauthenticated adjacent attackers can achieve full remote code execution on hosts running BrowserStack Runner, with no user interaction required.
Affected Products
- BrowserStack Runner versions up to and including 0.9.5
- Node.js environments hosting the vulnerable /_log HTTP handler
- CI/CD systems and developer workstations running BrowserStack Runner locally
Discovery Timeline
- 2026-06-02 - CVE-2026-49143 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-49143
Vulnerability Analysis
BrowserStack Runner exposes an HTTP handler at /_log to ingest log data from test sessions. The handler accepts JSON request bodies and passes attacker-controlled fields into vm.runInNewContext() together with eval(). The Node.js vm module is not a security boundary, and combining it with eval() on untrusted input produces a direct code injection sink [CWE-94].
Because the handler requires no authentication and listens on a network-reachable interface, any attacker on the adjacent network can deliver a payload. Successful exploitation grants code execution under the privileges of the BrowserStack Runner process, which typically runs on developer workstations or CI agents with broad filesystem and network access.
Root Cause
The root cause is the use of vm.runInNewContext() and eval() to process untrusted JSON content received over HTTP. The vm sandbox shares object prototypes with the host context, allowing references obtained from host-provided helpers such as util.format to expose constructors that escape the sandbox. Input validation and sandbox isolation are both absent on the /_log path.
Attack Vector
An attacker on the same network segment sends a crafted HTTP POST request with a malicious JSON body to the /_log endpoint. The payload references this.constructor.constructor through a host-context Function object reachable via util.format, reconstructing the host Function constructor inside the sandbox. Invoking this reconstructed constructor executes arbitrary JavaScript in the host process, enabling command execution, file access, and lateral movement from the compromised runner host. See the VulnCheck Advisory on RCE and the GitHub Security Advisory for technical details.
Detection Methods for CVE-2026-49143
Indicators of Compromise
- HTTP POST requests to the /_log endpoint containing JSON fields with constructor, Function, or util.format references
- Unexpected child processes spawned by the Node.js process hosting BrowserStack Runner
- Outbound network connections from the runner host to attacker-controlled infrastructure following /_log requests
- BrowserStack Runner listening on interfaces reachable beyond localhost
Detection Strategies
- Inspect HTTP access logs for requests to /_log originating from non-local addresses or containing JavaScript syntax in JSON values
- Monitor process trees for node parents launching shells, scripting interpreters, or system utilities such as bash, powershell, or curl
- Apply EDR behavioral rules to flag Node.js processes performing credential access, persistence creation, or unusual filesystem enumeration
Monitoring Recommendations
- Forward HTTP and process telemetry from CI agents and developer workstations to a centralized analytics platform for correlation
- Alert on any BrowserStack Runner instance binding to non-loopback addresses
- Track outbound DNS and TCP connections from runner hosts and baseline against expected BrowserStack endpoints
How to Mitigate CVE-2026-49143
Immediate Actions Required
- Upgrade BrowserStack Runner to a version above 0.9.5 once a patched release is available from the maintainers
- Restrict the /_log listener to 127.0.0.1 and block external access at the host firewall
- Remove BrowserStack Runner from any always-on or internet-adjacent hosts and run it only for the duration of test sessions
Patch Information
Refer to the GitHub Security Advisory GHSA-6vr3-7wcx-v5g5 for the authoritative list of fixed versions and remediation guidance. Until a fixed release is applied, treat any host running BrowserStack Runner 0.9.5 or earlier as exposed.
Workarounds
- Bind the runner to the loopback interface and require SSH tunneling for remote access
- Place the runner host behind a network access control list that permits only trusted CI orchestrators
- Disable or proxy the /_log handler if local instrumentation allows, blocking unauthenticated JSON submissions
# Configuration example: restrict runner exposure with host firewall (Linux)
sudo iptables -A INPUT -p tcp --dport 8889 ! -s 127.0.0.1 -j DROP
sudo iptables -A INPUT -p tcp --dport 8889 -s 127.0.0.1 -j ACCEPT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
