7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-57283

CVE-2025-57283: BrowserStack Local vulnerable to Command Injection through logfile variable

The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-57283

CVE-2025-57283:

7.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
browserstack-local	npm	<= 1.5.8	1.5.9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the browserstack-local package because it allows for command injection through the logfile option. The root cause is the improper sanitization of the logfile variable within the Local.js file. The Local.start and Local.startSync methods both construct a shell command string by concatenating the user-controlled logfile variable. This string is then executed via childProcess.exec(). An attacker can provide a specially crafted logfile value (e.g., 'test; touch pwned; #') to terminate the intended command and execute arbitrary commands on the system where the package is being run. The addArgs function is responsible for processing the malicious input, and the sanitizePath function fails to prevent the injection as it only adds quotes on Windows systems without escaping shell metacharacters.

Vulnerable functions

Local.startSync

lib/Local.js

The function `startSync` is vulnerable to command injection. It uses the `logfile` property, which can be controlled by user input, to construct a shell command that is executed by `childProcess.exec`. The `logfile` variable is not properly sanitized, allowing an attacker to inject arbitrary commands.

Local.start

lib/Local.js

The function `start` is vulnerable to command injection. It uses the `logfile` property, which can be controlled by user input, to construct a shell command that is executed by `childProcess.exec`. The `logfile` variable is not properly sanitized, allowing an attacker to inject arbitrary commands.

Local.addArgs

lib/Local.js

This function processes the options passed to `start` and `startSync`, including the malicious `logfile` input. It assigns the user-provided value to the `this.logfile` property after passing it through the ineffective `sanitizePath` function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.