CVE-2026-25244 WebdriverIO has Command Injection in the BrowserStack Service
Attackers can execute arbitrary code on CI/CD servers and developer machines by exploiting unsanitized git branch names in WebdriverIO's BrowserStack service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25244?
CVE-2026-25244 is a critical command injection vulnerability in webdriverio, published on 18 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution (RCE) in test orchestration. Git permits branch names containing shell metacharacters, and getGitMetadataForAISelection() interpolates these names directly into execSync() calls without sanitization. An attacker can exploit this by supplying a malicious repository (via testOrchestrationOptions.runSmartSelection.source, or the current directory if unset) whose branch name carries a payload, causing the shell to execute arbitrary code. This enables remote code execution on CI/CD servers and developer machines, leading to credential and secret disclosure, source code and SSH key exfiltration, system compromise, and supply chain attacks via tampered build artifacts. The issue has been fixed in version 9.24.0.
Weakness: CWE-78
Which versions are affected by CVE-2026-25244?
2 open source packages ship an affected version, including @wdio/browserstack-service. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@wdio/browserstack-service npm | All versions | 9.24.0 |
@wdio/browserstack-service npm | All versions | 9.24.0 |
Products include Openjsf Webdriverio.
How do I fix CVE-2026-25244?
Upgrade @wdio/browserstack-service to 9.24.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-25244 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-25244 exists.
Sources
Also known as GHSA-5c46-x3qw-q7j7.