https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T18:26:22.630332+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-327600 EUVD-2026-327600 2026-10-05T18:26:22.660331+00:00 EUVD-2026-327600 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48723 fkie_cve-2026-48723 2026-10-05T18:26:22.660363+00:00

The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via the cypress_config_file configuration parameter. In readCypressConfigUtil.js, the loadJsFile() function constructs a shell command by interpolating the user-controlled cypress_config_filepath value into a template literal, then executes it via child_process.execSync(). Shell metacharacters in the config path (specifically " and ;) allow breaking out of the quoted argument and injecting arbitrary commands. This issue has been fixed in version 1.36.6.