{"id":"EUVD-2026-34029","enisaUuid":"79524890-ff01-3ac4-bbea-2d2e946aaceb","description":"BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication.","datePublished":"Jun 2, 2026, 8:31:16 PM","dateUpdated":"Oct 8, 2026, 3:23:02 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/browserstack/browserstack-runner/security/advisories/GHSA-6vr3-7wcx-v5g5\nhttps://www.vulncheck.com/advisories/browserstack-runner-unauthenticated-rce-via-log-http-handler\n","aliases":"CVE-2026-49143\nGHSA-6vr3-7wcx-v5g5\n","assigner":"VulnCheck","epss":0.8,"enisaIdProduct":[{"id":"89dc4630-fea5-3b9c-a7c5-adcf826214cd","product":{"name":"browserstack-runner","vendor":{"name":"browserstack"}},"product_version":"0 ≤0.9.5"}],"enisaIdVendor":[{"id":"3a89a49d-4038-3590-8949-147dff69d6d4","vendor":{"name":"browserstack"}}],"enisaIdVulnerability":[{"id":"122d076a-ecaa-3793-8d0c-052910d9a3ee","vulnerability":{"id":"CVE-2026-49143","description":"BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication.","datePublished":"Jun 2, 2026, 8:31:16 PM","dateUpdated":"Oct 8, 2026, 3:23:02 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/browserstack/browserstack-runner/security/advisories/GHSA-6vr3-7wcx-v5g5\nhttps://www.vulncheck.com/advisories/browserstack-runner-unauthenticated-rce-via-log-http-handler\n","enisa_id":"EUVD-2026-34029\n","assigner":"VulnCheck","epss":0.8,"dataProcessed":"Nov 7, 2026, 7:22:41 AM","vulnerabilityProduct":[{"id":"4e8e5679-63f5-3a6e-b9f7-3c2c145a74ee","product":{"name":"browserstack-runner","vendor":{"name":"browserstack"}},"product_version":"0 ≤0.9.5"}],"vulnerabilityVendor":[{"id":"42db7dff-2554-3180-a740-a4ddcbdd7938","vendor":{"name":"browserstack"}}]}},{"id":"2131fbdf-f5cc-3967-a28b-0df3e3c75450","vulnerability":{"id":"GHSA-6vr3-7wcx-v5g5","description":"browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler","datePublished":"Jun 3, 2026, 9:39:32 PM","dateUpdated":"Jun 3, 2026, 9:39:32 PM","baseScore":0.0,"references":"https://github.com/browserstack/browserstack-runner/security/advisories/GHSA-6vr3-7wcx-v5g5\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49143\nhttps://github.com/browserstack/browserstack-runner\nhttps://www.vulncheck.com/advisories/browserstack-runner-unauthenticated-rce-via-log-http-handler\n","enisa_id":"EUVD-2026-34029\n","aliases":"GHSA-6vr3-7wcx-v5g5\nCVE-2026-49143\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}