CVE-2025-57283: Browserstack Browserstack-Local

High severity, CVSS 7.8. EPSS: 0.8% chance of exploitation in the next 30 days.

The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js.

Affected products

• Browserstack Browserstack-Local: version 1.5.8 only

Published 2026-01-28. Last modified 2026-07-15.