Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@wdio/browserstack-service

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8npmAmendedPublished

    WebdriverIO BrowserStack Service has a Command Injection issue

    CVE-2026-25244 · GHSA-5c46-x3qw-q7j7

    Affected
    • npm @wdio/browserstack-service <= 9.23.2
    Fixed in
    9.24.0· Vendor fix available
    Issue
    A command injection vulnerability exists in @wdio/browserstack-service that allows remote code execution (RCE) when processing git branch names in test orchestration. An attacker can exploit this by providing a malicious git repository with a branch name containing shell command injection payloads. Details Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer. Vulnerable Code File: https://github.com/webdriverio/webdriverio/blob/ea0e3e00288abced4c739ff9e46c46977b7cdbd2/packages/wdio-browserstack-service/src/testorchestration/helpers.ts#L204 Root Cause User-controlled git branch names are directly interpolated into execSync() calls without sanitization. Git allows branch names to contain special characters ,that can be used for command injection. Git allows to create these branches. Attack Vector 1. Attacker creates a malicious git repository with a branch name containing command injection payload 2. Attacker…

    Recommended action: Upgrade to 9.24.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →