CVE-2026-49143 is a remote code execution vulnerability in BrowserStack Runner (<=0.9.5) within the /_log HTTP handler. The handler processes user-supplied JSON data passed to vm.runInNewContext() combined with eval(), which is improperly controlled. Attackers can exploit this by crafting JSON requests that leverage a host-context Function reference via util.format to break out of the Node.js VM sandbox using this.constructor.constructor, achieving full remote code execution on the underlying system without any authentication or privileges.

An unauthenticated, network-adjacent attacker can execute arbitrary code on the host running BrowserStack Runner, leading to full compromise of the underlying system. This includes the ability to run any commands or code with the privileges of the BrowserStack Runner process. The vulnerability has a high severity score of 8.7 (CVSS 4.0) reflecting the ease of exploitation and impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the BrowserStack Runner service to trusted users only and monitor for suspicious activity targeting the /_log endpoint. Avoid exposing this service to untrusted networks.