{
  "cve_id": "CVE-2026-25244",
  "package": "@wdio/browserstack-service",
  "affected_version": "<= 9.23.2",
  "fixed_version": "9.24.0",
  "cvss_score": 9.8,
  "cwe": "CWE-78",
  "cwe_name": "OS Command Injection",
  "reproduction_status": "CONFIRMED",
  "reproduction_method": "PoC script demonstrating command injection via execSync() with shell string interpolation",
  "test_timestamp": "2025-01-22T09:10:42Z",
  "test_results": {
    "vulnerable_version_9_23_2": {
      "status": "VULNERABLE",
      "command_injection_confirmed": true,
      "vulnerability_pattern": "execSync() with template literal containing user-controlled branch names",
      "evidence": "Marker file created via injected shell command 'touch /tmp/pwned_vuln'"
    },
    "fixed_version_9_24_0": {
      "status": "FIXED",
      "command_injection_prevented": true,
      "fix_pattern": "spawnSync() with array arguments and isValidGitRef() validation",
      "evidence": "Marker file NOT created - shell interpretation prevented"
    }
  },
  "root_cause": {
    "vulnerable_code_location": "packages/wdio-browserstack-service/src/testorchestration/helpers.ts",
    "vulnerable_function": "getGitMetadataForAISelection()",
    "vulnerability_type": "OS Command Injection via execSync() string interpolation",
    "attack_vector": "Attacker-controlled branch names in CI/CD pipelines containing shell metacharacters"
  },
  "fix_analysis": {
    "fix_type": "Replace execSync() with spawnSync() using array arguments",
    "additional_fix": "Added isValidGitRef() validation function with SAFE_GIT_REF_PATTERN regex",
    "defense_in_depth": true
  },
  "impact": {
    "severity": "Critical",
    "risk": "Remote Code Execution (RCE) in CI/CD environments",
    "exploitation_requirements": [
      "Ability to create branch with shell metacharacters",
      "CI/CD pipeline running BrowserStack tests",
      "AI test selection feature enabled"
    ]
  },
  "recommendations": [
    "Upgrade to @wdio/browserstack-service@9.24.0 or later",
    "Avoid execSync() with string interpolation for user-controlled data",
    "Use spawnSync() with array arguments instead",
    "Validate git refs against safe patterns before use"
  ],
  "reproduction_script": "repro/reproduction_steps.sh",
  "script_exit_codes": {
    "vulnerable_test": 0,
    "fixed_test": 0,
    "overall_verdict": 0
  },
  "idempotency_verified": true,
  "notes": "Script successfully demonstrates the vulnerability in v9.23.2 (command injection via shell string interpolation) and confirms the fix in v9.24.0 (spawnSync with array arguments prevents shell interpretation). The fix uses defense-in-depth with both spawnSync and input validation."
}