CVE-2026-49144
MEDIUMBrowserStack Runner 0.9.5 Path Traversal via _default HTTP Handler
Title source: cnaDescription
BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside the project root and access sensitive files.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
https://github.com/browserstack/browserstack-runner/security/advisories/GHSA-8rpw-6cqh-2v9h
Third Party Advisory third-party-advisory
https://www.vulncheck.com/advisories/browserstack-runner-path-traversal-via-default-http-handler
Scores
CVSS v3
6.5
EPSS
0.0021
EPSS Percentile
10.8%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-22
Status
published
Products (2)
browserstack/browserstack-runner
< 0.9.5
npm/browserstack-runner
0 - 0.9.5npm
Published
Jun 02, 2026
Tracked Since
Jun 03, 2026