BrowserStack Runner versions up to 0.9.5 expose the "/_log" HTTP handler to unauthenticated remote code execution. The flaw allows an attacker to craft a JSON request that is forwarded directly to the Node.js VM sandbox via vm.runInNewContext() combined with eval(). By leveraging a host‑context Function reference through util.format, attackers can escape the sandbox and obtain a reference to the host process, ultimately executing arbitrary code on the underlying system.

All installations of BrowserStack Runner running version 0.9.5 or earlier are affected. The vulnerable component is the "_/log" HTTP handler provided by the BrowserStack Runner server.

The CVSS score of 8.7 indicates a high severity vulnerability. Attackers with network access adjacent to the host can exploit the flaw without any authentication, by submitting a specially crafted JSON payload to the vulnerable endpoint. Because the EPSS is not available and the issue is not listed in the CISA KEV catalog, the exact exploitation probability is unknown, but the critical nature of the flaw and the lack of authentication requirements make it a high‑risk target for attackers.