chromedriver Command Injection vulnerability

高 7.5CVE-2023-26156 · GHSA-hm92-vgmw-qfmx · 09/11/2023 公開 · 17/06/2026 更新

要点

CVE-2023-26156 は chromedriver (chromedriver project), chromedriver に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：2.2%（全脆弱性の 82.9% より高い）。
対処：119.0.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
chromedriver chromedriver_project	`< 119.0.1`	`119.0.1`
chromedriver npm	`< 119.0.1`	`119.0.1`

概要

Note:

An attacker must have access to the system running the vulnerable chromedriver library to exploit it. The success of exploitation also depends on the permissions and privileges of the process running chromedriver.

NVD の説明

Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to unauthorized access and potentially malicious actions on the host system. **Note:** An attacker must have access to the system running the vulnerable chromedriver library to exploit it. The success of exploitation also depends on the permissions and privileges of the process running chromedriver.