Browserstack-Local Command Injection Vulnerability

A command injection vulnerability has been identified in the Node.js package Browserstack-Local, specifically in version 1.5.8. The issue arises because the logfile variable is not adequately sanitized in the file lib/Local.js.

Impact

Exploitation of this vulnerability allows for command injection, where an attacker can execute arbitrary commands on the server running the affected package.

Reproduction

To reproduce this vulnerability, require the 'browserstack-local' package and create a new Local instance. Set the logfile property to a string that includes a command injection payload, such as a command to create a file. Then, call the startSync method to trigger the injection. This will execute the injected command and create the specified files in the current directory.