Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON request bodies to the handler, which passes user-supplied data to vm.runInNewContext() combined with eval(). Attackers can escape the Node.js vm sandbox by leveraging a host-context Function reference through util.format to access the host process via this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-03 | 2 | Disclosure2 |
| 2026-06-04 | 1 | Disclosure1 |
🔴 BrowserStack Runner, Code Injection, #CVE-2026-49143 (High) -DC-Jun2026-202 https://dailycve.com/browserstack-runner-code-injection-cve-2026-49143-high-dc-jun2026-202/
Post summary
The post announces a high‑severity code injection vulnerability in BrowserStack Runner, providing a link to further details but no PoC, exploit code, or patch information.
🚨*CVE* CVE-2026-49143 BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to e… https://www.cve.org/CVERecord?id=CVE-2026-49143 ----- Traducción: CVE-2026-49143 Bro… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑49143, detailing a remote code execution issue in BrowserStack Runner's _log handler, but does not provide any proof of concept, exploit code, or patch information.
CVE-2026-49143 BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attackers to e… https://www.cve.org/CVERecord?id=CVE-2026-49143
Post summary
The text announces CVE‑2026‑49143 as a remote code execution flaw in BrowserStack Runner 0.9.5, providing basic technical details but no exploit code, patch info, or evidence of active attacks.