What’s Vulnerable › Vulnerabilities

CVE-2026-49144: BrowserStack Runner 0.9.5 Path Traversal via _default HTTP Handler

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-02 · updated 2026-10-08
• Weakness: CWE-22

Description

BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside the project root and access sensitive files.

Affected products

• browserstack-runner: through 0.9.5

References

• https://github.com/browserstack/browserstack-runner/security/advisories/GHSA-8rpw-6cqh-2v9h
• https://www.vulncheck.com/advisories/browserstack-runner-path-traversal-via-default-http-handler
• https://github.com/browserstack/browserstack-runner/security/advisories/GHSA-8rpw-6cqh-2v9h

Get alerted when CVE-2026-49144 or the next vulnerability affects your stack