The browserstack-local package contains a command injection vulnerability that allows a local authenticated attacker to achieve full system compromise.

This is a command injection flaw located in lib/Local.js, where the logfile variable is not properly sanitized. The vulnerability requires a local attacker with at least low-level privileges to trigger the execution of arbitrary commands.

Successful exploitation of this vulnerability permits an attacker to execute arbitrary commands on the host system, leading to a complete compromise of confidentiality, integrity, and availability. While the CVSS score of 7.8 indicates high severity, the requirement for local access limits the immediate scope to environments where untrusted users possess local system access.

Immediate Action: Update the browserstack-local package to version 1.5.9 or later to incorporate the necessary input sanitization.

Proactive Monitoring: Review system logs and application execution history for anomalous process creation or unexpected shell command execution originating from the browserstack-local utility.

Compensating Controls: Restrict file system permissions for the directory containing the vulnerable package to prevent unauthorized modification or execution of the associated JavaScript files.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub Gist referenced by the vulnerability record.

The presence of a command injection vulnerability in a development utility poses a significant risk to the underlying host environment. Administrators are advised to prioritize the update to version 1.5.9 immediately to eliminate the attack vector, as the flaw is well-documented and reachable by any user capable of interacting with the package.