Loading vulnerability…
Unauthenticated RCE in BrowserStack Runner /_log Handler
CVE-2026-49143 is an unauthenticated remote code execution vulnerability affecting BrowserStack Runner through version 0.9.5. The flaw resides in the /_log HTTP handler, which accepts crafted JSON request bodies and passes attacker-controlled data into vm.runInNewContext() in combination with eval(). This unsafe evaluation path allows an attacker to inject JavaScript into the handler’s processing logic. The provided analysis indicates that exploitation targets the arguments array in the JSON body and abuses a host-context Function reference via util.format to escape the intended Node.js vm sandbox. By traversing the constructor chain, for example via this.constructor.constructor("return process")(), an attacker can recover the host Node.js process object and then invoke process.mainModule.require('child_process').execSync() or similar primitives to execute operating system commands on the underlying host.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation yields full remote code execution on the system running BrowserStack Runner. An unauthenticated network-adjacent attacker can execute arbitrary shell commands in the context of the runner process, potentially exposing command output in HTTP responses or process logs. The impact includes complete compromise of confidentiality, integrity, and availability of the affected host, and may also expose sensitive process-context data such as environment variables, including BrowserStack credentials or access keys if present.
If you can’t patch tonight, do this now.
Until a fixed release is available, restrict access to BrowserStack Runner so the listening port is not reachable from untrusted systems. Bind the service to localhost only, apply host firewall rules or network segmentation to block inbound access, and disable or avoid exposing the vulnerable /_log handler if possible. For organizations maintaining an internal fork or patch, add authentication checks to /_log and remove the unsafe dynamic code execution path.
Patch, then assume compromise.
Upgrade to a vendor-fixed release when available; the provided content does not identify a fixed version. Code-level remediation should remove eval() and vm.runInNewContext() from the /_log handler and replace the current behavior with safe serialization/logging such as JSON.stringify() or equivalent non-executable parsing. The /_log endpoint should also enforce authentication comparable to the _progress and _report handlers, and the runner service should be configured to bind to 127.0.0.1 rather than 0.0.0.0 where feasible.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.