GHSA-g4w6-c99w-4wh7
BrowserStack Local vulnerable to Command Injection through logfile variable
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | browserstack-local | < 1.5.9 | 1.5.9 |
Details
As written in the advisory (Markdown source, shown as plain text).
The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js.
References
External links from the advisory. They lead to third-party sites.