CVE-2026-49144
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Jun 02, 2026
Vendor
unknown
Description
BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside the project root and access sensitive files.