CVE-2026-48723: BrowserStack Cypress CL: Command Injection via cypress_config_file leads to arbitrary code execution through malicious browserstack.json

Synopsis

Command injection in the BrowserStack Cypress CLI (browserstack-cypress-cli) allows an attacker to execute arbitrary operating system commands by supplying a malicious cypress_config_file path containing shell metacharacters. The vulnerability is reached locally and requires no authentication, but does require the victim to open or process a crafted browserstack.json file. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability on the host running the CLI. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is confirmed published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required.

• AuthenticationNot required

  No account or credential is needed to deliver the malicious config file.

• Victim interactionRequired

  A developer or CI process must open or execute the CLI against a crafted browserstack.json containing a poisoned cypress_config_file path.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim processes the malicious file; no race conditions or special memory layout is required.

Blast Radius

• Reads any files accessible to the user running the CLI, including environment variables, secrets, and SSH keys stored on the CI runner or developer workstation.
• Writes or overwrites files on the host, allowing the attacker to plant backdoors or corrupt build artifacts.
• Executes arbitrary processes under the identity of the CLI user, enabling lateral movement within the CI environment or exfiltration to attacker-controlled infrastructure.
• Crashes or disrupts the CI pipeline by terminating processes or corrupting the working directory.