CVE-2026-49144: BrowserStack Runner 0.9.5 Path Traversal via _default HTTP Handler

Synopsis

Path traversal vulnerability in BrowserStack Runner (versions up to and including 0.9.5) allows unauthenticated attackers on the same network to read arbitrary files from the host. The flaw is in the _default HTTP handler in lib/server.js, which binds on all interfaces without authentication, letting attackers craft requests that walk outside the intended project root directory. Successful exploitation gives the attacker read access to any file the process can reach on disk, including secrets, credentials, and configuration files. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network (LAN, VPN, or equivalent), as the vulnerable HTTP server is bound on all interfaces but reachable from the local network segment rather than the open internet.

• AuthenticationNot required

  The HTTP server exposed by BrowserStack Runner performs no authentication, so any adjacent-network host can send exploit requests without credentials.

• Victim interactionNot required

  No user action is needed; the attacker sends crafted HTTP requests directly to the listening server.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: no race conditions or special environmental state are required to successfully traverse the path.

Blast Radius

• Reads arbitrary files accessible to the BrowserStack Runner process, including files outside the project root such as private keys, API tokens, and shell configuration files.
• Exposes environment variable files (for example .env files) that may contain database passwords, cloud provider credentials, or third-party service secrets.
• Allows enumeration of directory structures and application source code, giving an attacker a map of the host for follow-on attacks.