npmPackage

browserstack-runner

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Latest release: 0.9.4 (Dec 16, 2020): affected by 2 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 2 · 2 high

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-49144High 7.1
BrowserStack Runner 0.9.5 Path Traversal via _default HTTP Handler
Affected: through 0.9.5.
No fix released. The latest release, 0.9.4, is still affected.
100% of browserstack-runner downloads last week were affected versions (1.6K).
CVE-2026-49143High 8.7
BrowserStack Runner 0.9.5 Unauthenticated RCE via /_log HTTP Handler
Affected: through 0.9.5.
No fix released. The latest release, 0.9.4, is still affected.
100% of browserstack-runner downloads last week were affected versions (1.6K).