CVE-2026-49144 is a path traversal vulnerability in browserstack-runner through version 0.9.5. The issue exists in the _default HTTP handler implemented in lib/server.js, which does not properly restrict pathname access. An unauthenticated attacker on the network can exploit the HTTP server, which listens on all interfaces, to traverse directories outside the intended project root and read arbitrary files. This could lead to disclosure of sensitive information. No official patch or remediation level has been provided in the available data.

Successful exploitation allows unauthenticated attackers with network adjacency to read arbitrary files on the system running browserstack-runner. This can lead to sensitive information disclosure. There is no indication of privilege escalation, denial of service, or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the HTTP server to trusted users only and consider disabling or limiting the HTTP interface if possible.