CVE-2026-49144: BrowserStack Runner Path Traversal Flaw

CVE-2026-49144 Overview

CVE-2026-49144 is a path traversal vulnerability in BrowserStack Runner versions through 0.9.5. The flaw resides in the _default HTTP handler within lib/server.js. Unauthenticated network-adjacent attackers can traverse outside the project root and read arbitrary files from the host running BrowserStack Runner. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

BrowserStack Runner exposes an HTTP server bound on all interfaces by default. This binding allows any host on the same network segment to issue crafted requests that escape the intended file scope. Sensitive files including source code, credentials, configuration, and SSH keys are exposed when reachable through the runner process's user context.

Critical Impact
Unauthenticated adjacent attackers can read arbitrary files from systems running BrowserStack Runner through 0.9.5, exposing credentials, source code, and configuration data.

Affected Products

BrowserStack Runner versions through 0.9.5
Node.js test environments invoking the BrowserStack Runner CLI
CI/CD agents executing BrowserStack Runner on shared networks

Discovery Timeline

2026-06-02 - CVE-2026-49144 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-49144

Vulnerability Analysis

BrowserStack Runner spawns a local HTTP server through lib/server.js to serve test assets to remote browsers during automated runs. The _default request handler maps inbound URL paths directly to filesystem paths beneath the project root. The handler does not normalize or validate path components such as .. sequences before resolving the file location. As a result, an attacker submitting a crafted URL can traverse upward and request files outside the intended directory.

The HTTP listener binds to 0.0.0.0 rather than 127.0.0.1. This binding exposes the server to every host that can reach the listening port on the local network. No authentication, token, or origin check guards the handler. Attackers on the same Wi-Fi segment, VPN, or container network can therefore exploit the issue without credentials or user interaction.

Readable targets include package.json, environment files, build artifacts, browser test fixtures containing API tokens, and any operating-system file readable by the runner process. On developer workstations this often includes ~/.ssh/id_rsa, ~/.aws/credentials, and .env files.

Root Cause

The root cause is missing canonicalization of the request path inside the _default handler. The handler concatenates the user-supplied path with the project root and reads the resulting file. Without verifying that the resolved path remains within the project root, the handler honors ../ traversal sequences supplied in the URL.

Attack Vector

Exploitation requires only network adjacency to the host running BrowserStack Runner. An attacker sends an HTTP GET request to the runner's listening port with a path containing traversal sequences such as /../../../../etc/passwd. The server returns the requested file's contents in the HTTP response body.

No synthetic exploit code is reproduced here. Refer to the GitHub Security Advisory GHSA-8rpw-6cqh-2v9h and the VulnCheck Advisory for vendor-confirmed technical details.

Detection Methods for CVE-2026-49144

Indicators of Compromise

HTTP request logs containing ../ or URL-encoded %2e%2e%2f sequences directed at BrowserStack Runner ports
Outbound HTTP responses from developer or CI hosts containing contents of /etc/passwd, .env, or SSH key material
Connections to the BrowserStack Runner listener originating from hosts that are not BrowserStack cloud endpoints

Detection Strategies

Inspect web server and proxy logs for path traversal patterns targeting Node.js test runner ports during BrowserStack execution windows
Alert on processes spawned by browserstack-runner that bind sockets to 0.0.0.0 rather than localhost
Correlate file-read telemetry on developer endpoints with active BrowserStack Runner sessions to spot unexpected access to credential files

Monitoring Recommendations

Capture and retain HTTP access logs from CI runners and developer workstations executing BrowserStack tests
Monitor network flows on developer subnets for unauthorized clients connecting to ephemeral high ports during test runs
Track package versions of browserstack-runner across repositories and CI fleets to identify hosts still on 0.9.5 or earlier

How to Mitigate CVE-2026-49144

Immediate Actions Required

Upgrade BrowserStack Runner to a version newer than 0.9.5 once a fixed release is published by the vendor
Restrict execution of BrowserStack Runner to isolated network segments with no untrusted hosts
Audit any host that has executed browserstack-runner on shared networks and rotate credentials potentially exposed through file reads

Patch Information

Consult the GitHub Security Advisory GHSA-8rpw-6cqh-2v9h for the fixed release and remediation guidance from the maintainers. The VulnCheck Advisory provides additional context on affected versions and exploitation prerequisites.

Workarounds

Run BrowserStack Runner only on hosts where the loopback interface is the sole reachable network path during test execution
Use host firewall rules to restrict inbound traffic to the runner's listening port to BrowserStack cloud IP ranges
Avoid executing the runner on multi-tenant networks, public Wi-Fi, or shared container networks until a patched version is deployed

bash

# Restrict BrowserStack Runner port to loopback using iptables
# Replace <PORT> with the runner's listening port
sudo iptables -A INPUT -i lo -p tcp --dport <PORT> -j ACCEPT
sudo iptables -A INPUT -p tcp --dport <PORT> -j DROP