Introduction Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to unauthorized access and potentially malicious actions on the host system. Note: An attacker must have access to the system running the vulnerable chromedriver library to exploit it. The success of exploitation also depends on the permissions and privileges of the process running chromedriver. Reference: https://github.com/advisories/GHSA-hm92-vgmw-qfmx Important Note: To exploit the vulnerable targets, an attacker needs local access to the machine. Mitigation To mitigate this issue, it is advised to upgrade your vulnerable package to the latest version. More specifically, upgrade the chromedriver package to version 119.0.1 or higher. At the time of this writing, the latest version for this package was 127.0.2, so it is advised to upgrade to this version, to stay up-to-date with any emerging threats. Run the following command to patch the target: kali@kali:~/vicarius$ npm install --save chromedriver@127.0.2 added 28 packages, changed 3 packages, and audited 64 packages in 20s 2 packages are looking for funding run `npm fund` for details 2 high severity vulnerabilities To address all issues (including breaking changes), run: npm audit fix --force Run `npm audit` for details. kali@kali:~/vicarius$ Detecting successful patching To detect the successful patching of the application, run the detection script again: kali@kali:~/vicarius$ bash detection.sh [-] The application seems to be patched against CVE-2023-26156. kali@kali:~/vicarius$ If the remediation script successfully finished, the output from the detection script should indicate the target has been successfully patched!