WebdriverIO BrowserStack Service has a Command Injection issue

Description

A command injection vulnerability exists in @wdio/browserstack-service that allows remote code execution (RCE) when processing git branch names in test orchestration. An attacker can exploit this by providing a malicious git repository with a branch name containing shell command injection payloads.

Recommendation

Update the @wdio/browserstack-service package to the latest compatible version. Followings are version details:

• Affected version(s): <= 9.23.2
• Patched version(s): 9.24.0

References

• GHSA-5c46-x3qw-q7j7
• CVE-2026-25244
• CWE-78
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• yii2-mcp-server has a Command Injection Issue - CVE-2026-7600
• electerm has Command Injection via runLinux funtion - CVE-2026-41501
• automagik-genie has a command injection vulnerability - CVE-2026-30635
• Systeminformation has a Command Injection via unsanitized interface parameter in wifi.js retry path - CVE-2026-26280

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@wdio/browserstack-service