CVE-2025-57283

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-57283
The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gist.github.com/Dremig/b639c61541dd1482007dc7a5cd7fefb1 Third Party Advisory
https://www.npmjs.com Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:browserstack:browserstack-local:1.5.8:*:*:*:*:node.js:*:*
History

09 Feb 2026, 19:17

Type Values Removed Values Added
First Time Browserstack browserstack-local
Browserstack
References () https://gist.github.com/Dremig/b639c61541dd1482007dc7a5cd7fefb1 - () https://gist.github.com/Dremig/b639c61541dd1482007dc7a5cd7fefb1 - Third Party Advisory
References () https://www.npmjs.com - () https://www.npmjs.com - Product
CPE cpe:2.3:a:browserstack:browserstack-local:1.5.8:*:*:*:*:node.js:*:*

29 Jan 2026, 16:16

Type Values Removed Values Added
CWE CWE-94
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8

28 Jan 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-28 16:16

Updated : 2026-02-09 19:17

NVD link : CVE-2025-57283

Mitre link : CVE-2025-57283

CVE.ORG link : CVE-2025-57283

JSON object : View

Products Affected

browserstack

  • browserstack-local
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')