CVE-2016-10589: Insecure Download of Resources in selenium-binaries
Summary
CVE-2016-10589: selenium-binaries downloads resources over HTTP. Affects selenium-binaries versions < 0.15.0. Fixed in 0.15.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
selenium-binaries is an npm package that provides resources for the Selenium WebDriver. It is used to automate web browsers for testing purposes. The package allows users to download and use the necessary binaries for different browsers. However, versions prior to 0.15.0 have a vulnerability that exposes users to potential code execution attacks. This vulnerability arises from the insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The insecure download of resources in selenium-binaries allows an attacker with a privileged network position to intercept the response and replace the executable with a malicious one. This can lead to code execution on the system running selenium-binaries. The vulnerability has a CVSS score of 8.1 (High severity).
How To Fix
Latest published version: 0.15.0 as of 23 Oct 2026
npm install selenium-binaries@0.15.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As an alternative to using selenium-binaries, users can switch to the official selenium bindings for node.js, called selenium-webdriver. This package is available on npm and provides a secure way to interact with Selenium WebDriver. Users can install selenium-webdriver using the following command: npm install selenium-webdriver
Conclusion
The insecure download of resources in selenium-binaries exposes users to potential code execution attacks. It is recommended to update to version 0.15.0 of selenium-binaries to fix this vulnerability. Alternatively, users can switch to selenium-webdriver as a secure alternative. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for selenium-binaries →
FAQ
selenium-binaries is an npm package that provides resources for the Selenium WebDriver. It allows users to download and use the necessary binaries for different browsers.
The vulnerability allows an attacker to replace the downloaded executable with a malicious one, potentially leading to code execution on the system running selenium-binaries.
To fix this vulnerability, update to version 0.15.0 of selenium-binaries using the command 'npm install selenium-binaries@0.15.0'.
Yes, users can switch to the official selenium bindings for node.js, called selenium-webdriver, as an alternative to using selenium-binaries.
The CVSS score of this vulnerability is 8.1 (High severity).
