BrowserStack Local vulnerable to Command Injection through logfile variable

HIGH 7.8CVE-2025-57283 · GHSA-g4w6-c99w-4wh7 · Published 28/01/2026 · updated 15/07/2026

In short

CVE-2025-57283 is a HIGH (CVSS 7.8) vulnerability affecting browserstack-local (browserstack), browserstack-local.
Chance of exploitation in the next 30 days (EPSS): 0.80%, higher than 56.8% of all vulnerabilities.
Fix: update to 1.5.9 or later.

Package	Affected versions	Patched versions
browserstack-local browserstack	`= 1.5.8`	No fix yet
browserstack-local npm	`< 1.5.9`	`1.5.9`

Description

The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js.

NVD description

The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free