Threats affecting pkg:npm/browserstack/browserstack-cypress-cli

CVE-2026-48723 is a high-severity OS command injection vulnerability in BrowserStack's browserstack-cypress-cli. Versions prior to 1.36.6 allow an attacker to inject arbitrary OS commands via the cypress_config_file parameter due to improper sanitization of shell metacharacters. This occurs because the loadJsFile() function executes a shell command constructed with user input without proper neutralization. The issue is fixed in version 1.36.6.