{"vulnerability": "CVE-2026-49143", "sightings": [{"uuid": "d5a13255-faff-45ee-9497-5b024c1bfce6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49143", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mndr2nst4p2o", "content": "CVE-2026-49143 - BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler\nCVE ID : CVE-2026-49143\n \n Published : June 2, 2026, 9:16 p.m. | 1\u00a0hour, 57\u00a0minutes ago\n \n Description : BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in th...", "creation_timestamp": "2026-06-02T23:34:40.523600Z"}, {"uuid": "9ec353fe-5a2f-4462-a184-7febec96cc66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49143", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mndlsens5v2p", "content": "\ud83d\udfe0 CVE-2026-49143 - High (8.8)\n\nBrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTT...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-49143/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-02T22:00:34.602100Z"}, {"uuid": "3bcd8173-053d-40c0-b0a4-8d202770ee7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-49143", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-6vr3-7wcx-v5g5", "content": "", "creation_timestamp": "2026-06-03T21:39:32.000000Z"}, {"uuid": "45dec213-990e-4ff0-8dbf-1532ef9c1a3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-49143", "type": "seen", "source": "https://gist.github.com/alon710/0a4fd57da163f29a224f9f12ea16fb50", "content": "# CVE-2026-49143: CVE-2026-49143: Unauthenticated Remote Code Execution in browserstack-runner\n\n> **CVSS Score:** 8.8\n> **Published:** 2026-06-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-49143\n\n## Summary\nAn unauthenticated remote code execution (RCE) vulnerability exists in the browserstack-runner npm package (versions up to and including 0.9.5). The flaw lies in the /_log HTTP endpoint handler, which evaluates user-supplied input within a non-secure Node.js VM context combined with dynamic eval() execution. Network-adjacent attackers can exploit this behavior to escape the sandbox and execute arbitrary system commands on the host machine.\n\n## TL;DR\nUnauthenticated remote code execution vulnerability in browserstack-runner <= 0.9.5 via a sandbox escape in the /_log HTTP handler.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94: Improper Control of Generation of Code ('Code Injection')\n- **Attack Vector**: Adjacent Network\n- **CVSS v3.1 Score**: 8.8\n- **CVSS v4.0 Score**: 8.7\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n- **Impact**: High (Complete Confidentiality, Integrity, and Availability Loss)\n\n## Affected Systems\n\n- Workstations running browserstack-runner configurations locally\n- Continuous integration (CI/CD) runners executing automated cross-browser suites\n- Local development servers utilizing browserstack-runner <= 0.9.5\n- **browserstack-runner**: <= 0.9.5\n\n## Mitigation\n\n- Avoid using Node.js standard vm modules or eval() routines to parse user-controlled input.\n- Restrict HTTP listener bindings in lib/server.js to 127.0.0.1 instead of 0.0.0.0 to prevent adjacent network access.\n- Introduce token-based session validation checks on the /_log endpoint to reject unauthenticated requests.\n\n**Remediation Steps:**\n1. Open the file lib/server.js within the browserstack-runner installation directory.\n2. Locate the route definition mapping to the /_log handler.\n3. Replace the call to vm.runInNewContext() and eval() with a safe mapping function that stringifies or sanitizes arguments.\n4. Modify the HTTP listen configuration to specify host '127.0.0.1' rather than binding to all network interfaces.\n\n## References\n\n- [GitHub Security Advisory (GHSA-6vr3-7wcx-v5g5)](https://github.com/browserstack/browserstack-runner/security/advisories/GHSA-6vr3-7wcx-v5g5)\n- [VulnCheck Advisory Portal](https://www.vulncheck.com/advisories/browserstack-runner-unauthenticated-rce-via-log-http-handler)\n- [NVD Entry for CVE-2026-49143](https://nvd.nist.gov/vuln/detail/CVE-2026-49143)\n- [GitHub Project Repository](https://github.com/browserstack/browserstack-runner)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-49143) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-03T22:40:56.000000Z"}]}