CVE-2023-26156

Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to unauthorized access and potentially malicious actions on the host system. **Note:** An attacker must have access to the system running the vulnerable chromedriver library to exploit it. The success of exploitation also depends on the permissions and privileges of the process running chromedriver.

• CWE-78
• CWE-78
• CWE-78

• https://gist.github.com/mcoimbra/47b1da554a80795c45126d51e41b2b18Exploit
• https://github.com/giggio/node-chromedriver/commit/de961e34e023afcf4fa5c0faeeec69aaa6c3c815Patch
• https://security.snyk.io/vuln/SNYK-JS-CHROMEDRIVER-6049539Third Party Advisory
• https://gist.github.com/mcoimbra/47b1da554a80795c45126d51e41b2b18Exploit
• https://github.com/giggio/node-chromedriver/commit/de961e34e023afcf4fa5c0faeeec69aaa6c3c815Patch
• https://security.snyk.io/vuln/SNYK-JS-CHROMEDRIVER-6049539Third Party Advisory

Published

Nov 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26150Versions of the package asyncua before 0.9.96 are vulnerable…7.5
• CVE-2023-26151Versions of the package asyncua before 0.9.96 are vulnerable…7.5
• CVE-2023-26152All versions of the package static-server are vulnerable to …7.5
• CVE-2023-26153Versions of the package geokit-rails before 2.5.0 are vulner…9.8
• CVE-2023-26154Versions of the package pubnub before 7.4.0; all versions of…5.9
• CVE-2023-26155All versions of the package node-qpdf are vulnerable to Comm…9.8
• CVE-2023-26157Versions of the package libredwg before 0.12.5.6384 are vuln…7.5
• CVE-2023-26158All versions of the package mockjs are vulnerable to Prototy…8.2
• CVE-2023-26159Versions of the package follow-redirects before 1.15.4 are v…6.1
• CVE-2023-2616Cross-site Scripting (XSS) - Generic in GitHub repository pi…5.4
• CVE-2023-2617A vulnerability classified as problematic was found in OpenC…7.5
• CVE-2023-2618A vulnerability, which was classified as problematic, has be…7.5