CVE-2025-57283 is a high-severity command injection vulnerability affecting the Node.js browserstack-local package, specifically version 1.5.8. This flaw stems from improper sanitization of the logfile variable in lib/Local.js, allowing an attacker to execute arbitrary commands. With a CVSS score of 7.8, this vulnerability presents a significant risk, enabling high impact to confidentiality, integrity, and availability through local, low-complexity attacks. While there are no known public exploits or Metasploit modules, the vulnerability has garnered some community discussion and media coverage, indicating awareness within the security community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
1.5.8CPE matchmatch criteria | cpe:2.3:a:browserstack:browserstack-local:1.5.8:*:*:*:*:node.js:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.