GHSA-jh5w-6964-x5cf

Source

https://github.com/advisories/GHSA-jh5w-6964-x5cf

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-jh5w-6964-x5cf/GHSA-jh5w-6964-x5cf.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-jh5w-6964-x5cf

Aliases

CVE-2016-10579

Published

2019-02-18T23:58:05Z

Modified

2025-07-11T14:30:55Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

chromedriver Downloads Resources over HTTP

Details

Affected versions of chromedriver insecurely download resources over HTTP.

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This may result in arbitrary code execution if an attacker intercepts and modifies the downloaded binary file, replacing it with a malicious one.

Recommendation

Update to version 2.26.1 or later.

Database specific

{
    "cwe_ids":  [
        "CWE-311"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-06-16T21:43:26Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / chromedriver

Package

Name: chromedriver; View open source insights on deps.dev
Purl: pkg:npm/chromedriver

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.25.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/02/GHSA-jh5w-6964-x5cf/GHSA-jh5w-6964-x5cf.json"