Browserstack vulnerabilities
We track 3 vulnerabilities in Browserstack products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on June 15, 2026.
Latest Browserstack vulnerabilities
- 7.8 High severity
browserstack-cypress-cli: Improper Neutralization of Special Elements used in an OS Command
The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via the cypress_config_file configuration parameter. In readCypressConfigUtil.js, the lo
- 8.8 High severity
browserstack-runner: Improper Control of Generation of Code
BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes u
- 7.8 High severity
Red Hat Fuse 7: Improper Control of Generation of Code
The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js.