CVE-2026-49143 BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler
Unauthenticated attackers can execute arbitrary code on systems running BrowserStack Runner by sending crafted JSON payloads to the /_log handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-49143?
CVE-2026-49143 is a high-severity code injection vulnerability in browserstack-runner, published on 2 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication.
Weakness: CWE-94
Which versions are affected by CVE-2026-49143?
2 open source packages ship an affected version, including browserstack-runner.
| Package | Affected | Fixed in |
|---|---|---|
browserstack-runner npm | All versions to 0.9.5 | None |
browserstack-runner npm | All versions to 0.9.5 | None |
How do I fix CVE-2026-49143?
No fix has been published for CVE-2026-49143 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-49143 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49143 exists.
Sources
Also known as GHSA-6vr3-7wcx-v5g5.