GitHub Advisoryadvisory · npm

GHSA-jh5w-6964-x5cf chromedriver Downloads Resources over HTTP

HIGH Published 2019-02-18 Modified 2025-07-11 Official page ↗
Aliases
CVE-2016-10579
Ecosystem
npm
Packages
chromedriver
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-311
Reviewed
2020-06-16

Affected packages

• npm chromedriver: < 2.25.2 → fixed in 2.25.2

Description

Affected versions of `chromedriver` insecurely download resources over HTTP. In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This may result in arbitrary code execution if an attacker intercepts and modifies the downloaded binary file, replacing it with a malicious one. Recommendation Update to version 2.26.1 or later.

Related

Alias · CVE (1)

  • CVE-2016-10579 Chromedriver is an NPM wrapper for selenium ChromeDriver. vulnerability

Weakness · CWE (1)

  • CWE-311 Missing Encryption of Sensitive Data weakness

References