Notifications
Clear all
Topic starter
21/08/2026 4:45 pm
TL;DR: WebdriverIO BrowserStack Service versions through 9.23.2 contain a critical command-injection flaw that lets attacker-controlled branch names reach execSync during smart-selection test orchestration, creating a path from test execution to arbitrary shell commands, according to Corgea. The issue shows how CI runners can turn repository metadata into supply-chain execution risk when secrets, tokens, and deployment credentials are present.
NHIMG editorial — based on content published by Corgea: WebdriverIO BrowserStack Service command injection and CVE-2026-25244
By the numbers:
- CVE-2026-25244 carries a GitHub CVSS 3.1 score of 9.8 critical.
- @wdio/browserstack-service versions through 9.23.2 are affected, and 9.24.0 is fixed.
Questions worth separating out
Q: What breaks when repository metadata is passed into shell commands during CI test orchestration?
A: Command injection becomes possible because the shell treats branch names, paths, and other metadata as executable syntax rather than data.
Q: Why do CI test runners increase the impact of command-injection flaws?
A: CI runners usually have broader access than a developer laptop because they can read source, fetch packages, publish artefacts, and reach cloud services.
Q: How do security teams know whether a test helper is creating supply chain risk?
A: Look for utilities that execute before deployment gates, consume untrusted repository inputs, and run with secrets capable of publishing, deploying, or authenticating to external services.
Practitioner guidance
- Upgrade vulnerable WebdriverIO packages immediately Move @wdio/browserstack-service to 9.24.0 or later and verify that lockfiles, transitive dependencies, and CI images no longer resolve to 9.23.2 or older.
- Disable smart selection for untrusted repositories Turn off BrowserStack smart-selection paths in any job that runs against forks, sample projects, generated repositories, or checkouts created by external contributors.
- Remove shell-string execution from orchestration helpers Replace execSync string commands with execFile or spawn-style argument arrays so branch names and other repo metadata are never parsed by a shell.
What's in the full analysis
Corgea's full analysis covers the operational detail this post intentionally leaves for the source:
- Exact vulnerable code path and advisory references for CVE-2026-25244
- Exploit examples showing how malicious branch names reach shell execution
- Detection and triage steps for npm, pnpm, and yarn dependency checks
- Remediation guidance for runner credential rotation after exposure
👉 Read Corgea's analysis of CVE-2026-25244 in WebdriverIO BrowserStack Service →
WebdriverIO command injection: what it means for CI/CD security teams?
Explore further
21/08/2026 5:05 pm
Test orchestration is now part of the application supply chain, not a neutral utility layer. This vulnerability shows that pre-release tooling can hold the same trust weight as build and deploy systems when it executes in privileged CI contexts. The real control failure is not weak test coverage, but untrusted input reaching a command interpreter before any release gate can intervene. Teams should treat orchestration code as security-sensitive supply chain code, not developer convenience.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: Who is accountable when a CI runner leaks credentials after a test-tool vulnerability?
A: The accountable owner is the team that controls the runner, the package allowance, and the secrets issued to the job. Security, platform, and engineering teams share responsibility, but the remediation decision sits with the system owner. Control frameworks such as NIST SP 800-53 and CIS Controls both expect explicit access governance and change control.
👉 Read our full editorial: WebdriverIO BrowserStack command injection shows test supply chain risk
