CVE-2023-26156 json
chromedriver Command Injection vulnerability
published 2023-11-09 3 y ago modified 2026-06-17 4 mo ago also GHSA-hm92-vgmw-qfmx , EUVD-2023-2976
- cvss
- 5.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.2%
- EPSS 2.2% chance of exploitation in 30 days, percentile 82%
- public exploits
- 0
- none known
Summary
Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to unauthorized access and potentially malicious actions on the host system. **Note:** An attacker must have access to the system running the vulnerable chromedriver library to exploit it. The success of exploitation also depends on the permissions and privileges of the process running chromedriver.
Patch / fix
- npm chromedriver 119.0.1
- n/a chromedriver 119.0.1
- chromedriver_project chromedriver 119.0.1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
2.23% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- gist.github.com https://gist.github.com/mcoimbra/47b1da554a80795c45126d51e41b2b18 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.6 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P |
| CNA | 3.1 | 5.6 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 5.6 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | chromedriver | <119.0.1 |
119.0.1 |
Affected products
- n/a chromedriver
- chromedriver_project chromedriver
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/giggio/node-chromedriver/commit/de961e34e023afcf4fa5c0faeeec69aaa6c3c815
web, patch
-
gist.github.com
/mcoimbra/47b1da554a80795c45126d51e41b2b18
web, exploit
-
security.snyk.io
/vuln/SNYK-JS-CHROMEDRIVER-6049539
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-26156
advisory
-
github.com
/giggio/node-chromedriver
web
Sources
- CVE List CVE-2023-26156
- GitHub Advisory GHSA-hm92-vgmw-qfmx
- NVD CVE-2023-26156
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.