BrowserStack Local vulnerable to Command Injection through logfile variable

HOCH 7.8CVE-2025-57283 · GHSA-g4w6-c99w-4wh7 · Published 28/01/2026 · updated 15/07/2026

Kurz gesagt

CVE-2025-57283 ist eine Schwachstelle (HOCH (CVSS 7.8)) in browserstack-local (browserstack), browserstack-local.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.80%, höher als bei 56.8% aller Schwachstellen.
Abhilfe: auf 1.5.9 oder neuer aktualisieren.

Package	Affected versions	Patched versions
browserstack-local browserstack	`= 1.5.8`	No fix yet
browserstack-local npm	`< 1.5.9`	`1.5.9`

Description

The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js.

NVD description

The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free