This vulnerability occurs in BrowserStack's Cypress CLI when the cypress_config_file parameter is used. The loadJsFile() function builds a shell command by inserting the user‑controlled configuration file path into a template literal and then executes it with child_process.execSync(). Shell metacharacters such as \\" and ; in the file path allow the attacker to break out of the quoted argument and inject arbitrary commands. The result is that any commands supplied by an attacker run with the privileges of the user invoking the CLI, compromising confidentiality, integrity, and availability of the system.

The issue affects the BrowserStack BrowserStack Cypress CLI for all releases prior to 1.36.4. Versions 1.36.6 and later contain a fix and are not vulnerable.

The CVSS score of 7.8 indicates a high impact vulnerability. The EPSS score is below 1%, suggesting a low probability of widespread exploitation today, and it is not listed in CISA’s KEV catalog. The likely attack vector is a local or CI environment where an attacker can supply a crafted cypress_config_file value to the CLI, enabling arbitrary command execution. The severity profile reaffirms that an attacker who can influence the CLI configuration can effectively take control of the host machine.