CVE-2026-49143: BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler

Synopsis

Remote code execution vulnerability in BrowserStack Runner through version 0.9.5. The /_log HTTP handler passes user-supplied JSON request bodies directly into vm.runInNewContext() combined with eval(), allowing an unauthenticated attacker on the same network segment to escape the Node.js vm sandbox and execute arbitrary code on the host system. No authentication is required, and no fix has been published yet; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same adjacent network, LAN, or VPN segment as the host running BrowserStack Runner; the /_log handler is not required to be exposed to the public internet for this attack to succeed.

• AuthenticationNot required

  The /_log HTTP handler accepts requests with no credentials; any unauthenticated client on the adjacent network can send the crafted payload.

• Victim interactionNot required

  The attack is fully automated and requires no action from any user or administrator on the target system.

• Attack complexityDetail

  Exploitation is reliable and condition-free once network adjacency is established; the sandbox escape technique via host-context Function references is well-documented and does not depend on race conditions or specific memory layout.

Blast Radius

• Attacker executes arbitrary operating system commands as the user running the BrowserStack Runner process.
• Attacker reads any file accessible to that process, including environment variables, secrets, and credentials stored on disk.
• Attacker modifies or deletes files and configurations on the host, corrupting test infrastructure or planting backdoors.
• Attacker disrupts the BrowserStack Runner service and any dependent CI/CD pipeline steps relying on it.