WebdriverIO versions prior to 9.24.0 contain a command injection flaw in the BrowserStack service’s test orchestration logic, which interprets Git branch names via execSync without sanitization. The flaw, classified as CWE‑78, enables an attacker who can supply a malicious repository or branch name to trigger arbitrary shell commands during test execution. This results in remote code execution on the machine running the tests, potentially exposing credentials, secrets, source code, and SSH keys to the attacker.

The vulnerability affects the WebdriverIO WebdriverIO framework, specifically configurations that use the BrowserStack service for test orchestration. All releases earlier than version 9.24.0 are vulnerable. Users running CI/CD pipelines or local developer environments that execute WebdriverIO tests with the BrowserStack service should verify whether a vulnerable version is in use.

The CVSS base score is 9.8, indicating a high likelihood of exploitation under realistic conditions. No EPSS score is publicly available, but the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a repository with a crafted branch name that is ingested by the test orchestration code; therefore, the attack vector is primarily local to the CI/CD or developer machine that runs WebdriverIO, although a malicious repository could be used remotely to infect a shared CI environment.