BrowserStack Local vulnerable to Command Injection through logfile variable

Description

The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 1.5.8

References

• GHSA-g4w6-c99w-4wh7
• www.npmjs.com
• CVE-2025-57283
• CWE-77
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Matrix IRC Bridge allows IRC command injection to own puppeted user - CVE-2025-27146
• Axios is vulnerable to DoS attack through lack of data size check - CVE-2025-58754
• Command injection in Parse Server through prototype pollution - CVE-2022-24760
• create-choo-app3 is vulnerable to Command Injection via the devInstall function - CVE-2022-25855

Tags:

npm

browserstack-local