Command Injection Vulnerability in BrowserStack Local by Node.js
CVE-2025-57283

7.8HIGH

Key Information:

Vendor

Node.js

Status
browserstack-local
Vendor
CVE Published:
28 January 2026

What is CVE-2025-57283?

The browserstack-local package version 1.5.8 has a command injection vulnerability due to improper sanitation of the logfile variable in its lib/Local.js file. This flaw can be exploited by attackers to execute arbitrary commands on affected systems, potentially leading to unauthorized access and control. It is essential for users of browserstack-local to review their implementation and apply necessary security measures to mitigate this risk.

References

https://www.npmjs.com
https://gist.github.com/Dremig/b639c61541dd1482007dc7a5cd...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.