browserstack/browserstack-cypress-cli

browserstack/browserstack-cypress-cli

Releases98

Frequency3 weeks 2 days

Last Release 10 days ago

Stars58

NPM package for the customers to run Cypress on Browserstack Infra

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2026-48723 ↗	Jun 15, 2026Monday, 15 June 2026, 23:16	7.8 HIGH	—
The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via the cypress_config_file configuration parameter. In readCypressConfigUtil.js, the loadJsFile() function constructs a shell command by interpolating the user-controlled cypress_config_filepath value into a template literal, then executes it via child_process.execSync(). Shell metacharacters in the config path (specifically " and ;) allow breaking out of the quoted argument and injecting arbitrary commands. This issue has been fixed in version 1.36.6.