Command Injection Affecting browserstack-cypress-cli package, versions >=1.22.0 <1.36.6

browserstack-cypress-cli is a BrowserStack Cypress CLI for Cypress integration with BrowserStack's remote devices.

Affected versions of this package are vulnerable to Command Injection via the loadJsFile() process in readCypressConfigUtil. An attacker can execute arbitrary commands by supplying a crafted cypress_config_filepaththat is interpolated into theexecSync()` command string. This lets a malicious config path break out of the intended Node invocation and run attacker-controlled shell commands on the host that loads the Cypress config, leading to remote code execution and compromise of the affected machine or build environment.

Notes

• The attack surface spans both Unix-like shells and Windows command processing, since the pre-fix code used a shell command string on each platform with different NODE_PATH handling.

Workarounds

• Restrict browserstack.json so only trusted users can set or edit run_settings.cypress_config_file; this blocks attackers from supplying a crafted path that injects shell commands when the CLI loads the Cypress config.
• Avoid running npx browserstack-cypress-cli run on untrusted repositories or cloned codebases with attacker-controlled browserstack.json; this prevents malicious cypress_config_file values from being processed on your machine or CI runner.

• GitHub Commit
• Maintainer's Advisory