CVE-2026-49144
Description
BrowserStack Runner 0.9.5 has a path traversal vulnerability allowing unauthenticated attackers to read arbitrary files.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
BrowserStack Runner 0.9.5 has a path traversal vulnerability allowing unauthenticated attackers to read arbitrary files.
Vulnerability
BrowserStack Runner versions through 0.9.5 contain a path traversal vulnerability in the _default HTTP handler located in lib/server.js. This handler joins the current working directory with the requested URI without validating that the resulting path remains within the project root. The HTTP server binds to all interfaces (0.0.0.0) and lacks any authentication, making it susceptible to exploitation.
Exploitation
An unauthenticated, network-adjacent attacker can exploit this vulnerability by sending a crafted HTTP request to the server. By using ../ sequences in the URI, the attacker can traverse outside the project's root directory. For example, an attacker could request ../../../etc/hostname or ../../../etc/passwd to read sensitive files from the host system [1]. The --path-as-is flag in curl is noted as necessary because curl normalizes path sequences by default, but other HTTP clients or browsers might not require this flag [1].
Impact
Successful exploitation allows an unauthenticated attacker to read arbitrary files from the host system. This could include sensitive configuration files, system credentials, or other private data, leading to information disclosure and potentially further compromise of the system [1, 2].
Mitigation
BrowserStack Runner versions through 0.9.5 are affected. A fixed version has not yet been disclosed in the available references. There are no workarounds mentioned. The Common Vulnerabilities and Exposures (CVE) list does not indicate if this vulnerability has been added to the Known Exploited Vulnerabilities (KEV) catalog [2].
AI Insight generated on Jun 2, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- Range: <=0.9.5
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The HTTP server handler improperly joins user-controlled URI paths with the current working directory without validating the resulting path remains within the project root."
Attack vector
An unauthenticated, network-adjacent attacker can exploit the HTTP server, which binds to all interfaces (0.0.0.0) and lacks authentication, to read arbitrary files. By sending a crafted URL containing path traversal sequences (e.g., `../../../etc/hostname`), the attacker can trick the server into serving files from outside the intended project directory [ref_id=1]. The `--path-as-is` flag in curl is noted as necessary because curl normalizes such sequences by default, but other HTTP clients may not [ref_id=1].
Affected code
The vulnerability resides in the `_default` handler within `lib/server.js`. Specifically, lines 530–534 show the handler constructing a file path using `path.join(process.cwd(), uri)`. The `uri` is derived from `url.parse(request.url).pathname`, which preserves `../` sequences. No boundary check is performed before calling `handleFile` with the potentially malicious `filePath` [ref_id=1]. The server binding on all interfaces is configured in `bin/cli.js` at line 131 [ref_id=1].
What the fix does
The suggested fix involves validating that the resolved file path, after joining with the current working directory, starts with the current working directory path. If the path attempts to traverse outside the project root, the server should return a 'Forbidden' error (403) instead of serving the file. Additionally, it is recommended to bind the server to `127.0.0.1` and implement authentication for the default handler to mitigate the vulnerability [ref_id=1].
Preconditions
- networkThe attacker must be on the same network as the target.
- authNo authentication is required to access the vulnerable HTTP server.
- inputThe attacker must send a crafted URL with path traversal sequences.
Reproduction
Step 1: Start the server by navigating to the browserstack-runner directory, creating a dummy HTML file (`_poc_test.html`), a `browserstack.json` configuration file, and running `node bin/runner.js`. Step 2: Use `curl` with the `--path-as-is` flag to request sensitive files, such as `http://127.0.0.1:8888/../../../etc/hostname` or `http://127.0.0.1:8888/../../../etc/passwd`, to observe the file disclosure [ref_id=1].
Generated on Jun 2, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2News mentions
0No linked articles in our index yet.