BrowserStack Runner through version 0.9.5 contains a path traversal vulnerability in its _default HTTP handler implemented in lib/server.js. The HTTP server listens on all network interfaces without authentication, enabling attackers with network access to traverse directories outside the intended project root and read arbitrary files. This vulnerability is classified as CVE-2026-49144 with a CVSS 4.0 score of 7.1 (high severity). No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

An unauthenticated attacker with network access to the BrowserStack Runner HTTP server can read arbitrary files on the host system outside the project directory. This could lead to disclosure of sensitive information stored on the affected system. There is no indication of privilege escalation, code execution, or impact beyond information disclosure. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict network access to the BrowserStack Runner HTTP server to trusted hosts only or disable the HTTP server if possible to prevent unauthorized file access.