BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows unauthenticated network-adjacent attacker…

BrowserStack Runner through version 0.9.5 contains a critical remote code execution vulnerability in the /_log HTTP handler. The vulnerability allows unauthenticated network-adjacent attackers to execute arbitrary code by submitting crafted JSON requests. Attackers can exploit the vm.runInNewContext() and eval() functions to escape the Node.js VM sandbox. The attack leverages util.format and this.constructor.constructor to access the host process, achieving full remote code execution without authentication.