NULL Pointer Dereference in selenium
Summary
CVE-2023-5590: NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.0. Affects selenium across 2 version ranges.
< 4.14.0
< 023a0d52f106321838ab1c0997e76693f4dcbdf6
Fixed in 023a0d52f106321838ab1c0997e76693f4dcbdf6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Selenium is a popular open-source framework used for automating web browsers. It provides a suite of tools and libraries for browser automation and testing. The vulnerability in question is a NULL Pointer Dereference in the seleniumhq/selenium GitHub repository prior to version 4.14.0.
Vulnerability Detail
The NULL Pointer Dereference vulnerability occurs when a NULL pointer is dereferenced, leading to a crash or unexpected behavior. In the case of selenium, this vulnerability can be triggered under certain conditions, potentially resulting in denial of service or other security issues. The vulnerability was introduced in version 0 of the repository and was fixed in commit 023a0d52f106321838ab1c0997e76693f4dcbdf6. The fixed version is 4.14.0.
How To Fix
Latest published version: 4.51.0 as of 23 Oct 2026
pip install --upgrade "selenium==4.51.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
023a0d52f106321838ab1c0997e76693f4dcbdf6
This is the first release that contains the fix.
pip install --upgrade "selenium==023a0d52f106321838ab1c0997e76693f4dcbdf6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the fixed version as soon as possible.
Conclusion
In conclusion, the NULL Pointer Dereference vulnerability in selenium can lead to crashes, unexpected behavior, and potential security issues. It is crucial to update to version 4.14.0 or later to mitigate the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for selenium →
FAQ
The vulnerability can lead to crashes or unexpected behavior in applications using the selenium package. It may also have security implications, potentially allowing attackers to exploit the vulnerability for malicious purposes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, the CVSS score for this vulnerability is 7.5, indicating a high severity.
There are no known exploits for this vulnerability at the moment. However, it is still important to update to the fixed version to prevent any potential exploitation.
You can find more information about this vulnerability in the advisory database maintained by the PyPA at https://github.com/pypa/advisory-database/blob/main/vulns/selenium/PYSEC-2023-206.yaml
References
Related vulnerabilities
Recent vulnerabilities recorded for selenium.
