TI-2023-11380 Aliases CVE-2023-26156 GHSA-hm92-vgmw-qfmx

OS command injection in chromedriver

HIGH 66CWE-78Published 2023-11-09 · Updated 2024-09-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to unauthorized access and potentially malicious actions on the host system. **Note:** An attacker must have access to the system running the vulnerable chromedriver library to exploit it. The success of exploitation also depends on the permissions and privileges of the process running chromedriver.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.02233 82nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed chromedriver: 119.0.1chromedriver (npm): 119.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	chromedriver	before 119.0.1	119.0.1	Patch available	CNA
—	chromedriver (npm)	before 119.0.1	119.0.1	Patch available	GHSA-hm92-vgmw-qfmx

chromedriver Vendor— Affected before 119.0.1 Fixed in 119.0.1 Patch available CNA
chromedriver (npm) Vendor— Affected before 119.0.1 Fixed in 119.0.1 Patch available GHSA-hm92-vgmw-qfmx

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:chromedriver_project:chromedriver::::::node.js::*	before 119.0.1	Vulnerable	Chromedriver Project

cpe:2.3:a:chromedriver_project:chromedriver:*:*:*:*:*:node.js:*:* Versions before 119.0.1 Vulnerable ·Chromedriver Project

Remediation

Fix · CNA chromedriver Fixed in 119.0.1
Fix · GHSA-hm92-vgmw-qfmx chromedriver (npm) Fixed in 119.0.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-26156
2026-10-03 Alias added: GHSA-hm92-vgmw-qfmx

References

TI-2016-08620 Cryptographic flaw in HackerOne chromedriver node module CVSS 3.0HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences