CVE-2023-26156: Command Injection vulnerability in chromedriver
Summary
CVE-2023-26156: chromedriver Command Injection vulnerability. Affects chromedriver versions < 119.0.1. Fixed in 119.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
chromedriver is an npm package that provides a WebDriver implementation for Chrome. It allows developers to automate interactions with the Chrome browser. The package is widely used in web development and testing scenarios. However, versions of chromedriver before 119.0.1 are vulnerable to a Command Injection vulnerability. This vulnerability arises when the chromedriver.path is set to an arbitrary system binary. Exploiting this vulnerability could lead to unauthorized access and potentially malicious actions on the host system. It is important to note that successful exploitation requires the attacker to have access to the system running the vulnerable chromedriver library, and the permissions and privileges of the process running chromedriver also play a role in the success of the attack.
Vulnerability Detail
The Command Injection vulnerability in chromedriver allows an attacker to execute arbitrary commands on the host system by manipulating the chromedriver.path configuration. By setting the path to a malicious system binary, an attacker can execute unauthorized actions with the privileges of the process running chromedriver. This can result in unauthorized access, data breaches, or other malicious activities. It is crucial to update to version 119.0.1 or later to mitigate this vulnerability.
How To Fix
Latest published version: 156.0.0 as of 23 Oct 2026
npm install chromedriver@156.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
119.0.1
This is the first release that contains the fix.
npm install chromedriver@119.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. Updating to the fixed version is the only recommended solution.
Conclusion
The Command Injection vulnerability in chromedriver can lead to unauthorized access and potentially malicious actions on the host system. It is crucial to update to version 119.0.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for chromedriver →
FAQ
chromedriver is an npm package that provides a WebDriver implementation for Chrome. It allows developers to automate interactions with the Chrome browser.
This vulnerability allows an attacker to execute arbitrary commands on the host system, potentially leading to unauthorized access and malicious actions.
To fix this vulnerability, update the chromedriver package to version 119.0.1 or later.
No, there is no known workaround for this vulnerability. Updating to the fixed version is the only recommended solution.
The attacker must have access to the system running the vulnerable chromedriver library. The success of exploitation also depends on the permissions and privileges of the process running chromedriver.
Related vulnerabilities
Recent vulnerabilities recorded for chromedriver.
