Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to unauthorized access and potentially malicious actions on the host system.
**Note:**
An attacker must have access to the system running the vulnerable chromedriver library to exploit it. The success of exploitation also depends on the permissions and privileges of the process running chromedriver.
References
Configurations
History
21 Nov 2024, 07:50
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.6 |
| References | () https://gist.github.com/mcoimbra/47b1da554a80795c45126d51e41b2b18 - Exploit | |
| References | () https://github.com/giggio/node-chromedriver/commit/de961e34e023afcf4fa5c0faeeec69aaa6c3c815 - Patch | |
| References | () https://security.snyk.io/vuln/SNYK-JS-CHROMEDRIVER-6049539 - Third Party Advisory |
17 Nov 2023, 17:46
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://security.snyk.io/vuln/SNYK-JS-CHROMEDRIVER-6049539 - Third Party Advisory | |
| References | () https://gist.github.com/mcoimbra/47b1da554a80795c45126d51e41b2b18 - Exploit | |
| References | () https://github.com/giggio/node-chromedriver/commit/de961e34e023afcf4fa5c0faeeec69aaa6c3c815 - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-78 | |
| CPE | cpe:2.3:a:chromedriver_project:chromedriver:*:*:*:*:*:node.js:*:* | |
| First Time |
Chromedriver Project chromedriver
Chromedriver Project |
09 Nov 2023, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-11-09 05:15
Updated : 2024-11-21 07:50
NVD link : CVE-2023-26156
Mitre link : CVE-2023-26156
CVE.ORG link : CVE-2023-26156
JSON object : View
Products Affected
chromedriver_project
- chromedriver
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')