chromedriver Command Injection vulnerability

Description

Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to unauthorized access and potentially malicious actions on the host system.

Recommendation

Update the chromedriver package to the latest compatible version. Followings are version details:

• Affected version(s): < 119.0.1
• Patched version(s): 119.0.1

References

• GHSA-hm92-vgmw-qfmx
• security.snyk.io
• CVE-2023-26156
• CWE-78
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• automagik-genie has a command injection vulnerability - CVE-2026-30635
• Nadesiko3 OS Command Injection vulnerability - CVE-2022-41642
• A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA - CVE-2023-33831
• matrix-appservice-irc IRC command injection via admin commands containing newlines - CVE-2023-38690

You might also like:

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Exploiting Server Version Disclosure

Tags:

npm

chromedriver