744 matches found
PYSEC-2026-1239 changedetection.io path traversal using file URI scheme without supplying hostname
Summary The validation for the file URI scheme falls short, and results in an attacker being able to read any file on the system. This issue only affects instances with a webdriver enabled, and ALLOWFILEURI false or not defined. Details The check used for URL protocol, issafeurl, allows file: as ...
PYSEC-2026-1240 changedetection.io Path Traversal
Summary When a WebDriver is used to fetch files source:file:///etc/passwd can be used to retrieve local system files, where the more traditional file:///etc/passwd gets blocked Details The root cause is the payload source:file:///etc/passwdpasses the regex here and also passes the check here wher...
Astra Linux – Vulnerability in Firefox
The Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user’s browser to control it. This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.. This vulnerability...
Selenium Grid/Selenoid Unauthenticated RCE
Selenium Grid and Selenoid expose a WebDriver API that allows creating browser sessions with arbitrary capabilities. When deployed without authentication the default for both, an attacker can achieve remote code execution through two browser-specific techniques: For Chrome, the goog:chromeOptions...
@activepieces/piece-google-gemini (=0.1.6), @activepieces/piece-google-vertexai (=0.1.2) +9 more potentially affected by CVE-2026-33750 via brace-expansion (>=2.0.0 <=2.0.2)
brace-expansion NPM version =2.0.0, =0.2.1, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver =1.1.2 - nx-cargo =1.0.0-alpha.2 Source cves: CVE-2026-33750 Source advisory: SNYK:JS-BRACEEXPANSION-15789759...
@activepieces/piece-google-gemini (=0.1.6), @activepieces/piece-google-vertexai (=0.1.2) +9 more potentially affected by CVE-2026-33750 via brace-expansion (>=2.0.0 <=2.0.2)
brace-expansion NPM version =2.0.0, =0.2.1, =1.16.0, =1.0.1, =0.0.20, =15.0.0 - fluid-webdriver =1.1.2 - nx-cargo =1.0.0-alpha.2 Source cves: CVE-2026-33750 Source advisory: OSV:GHSA-F886-M6HF-6M8V...
Astra Linux – Vulnerability in Zabbix
The WebDriver for the Browser object expects an error object to be initialized when the webdriversessionquery function fails. However, this function can fail for various reasons without an error description. As a result, wd-error will be NULL, and attempting to access it will cause a crash...
EUVD-2025-177717
Malicious code in mysql-spectron-webdriver-primatology-eslint-plugin npm...
EUVD-2025-179712
Malicious code in cli-webdriver-manager-lint-staged-auth npm...
EUVD-2025-176542
Malicious code in sails-soap-link-webdriver-mocha npm...
EUVD-2025-179439
Malicious code in cygnus-umbra-webdriver-mocha-docusaurus npm...
EUVD-2025-178269
Malicious code in jovian-postgres-webdriver-mocha-await npm...
EUVD-2025-176435
Malicious code in semantic-release-webdriver-mocha-holography-init npm...
EUVD-2025-175619
Malicious code in webdriver-manager-aether-less-loader-mensa npm...
EUVD-2025-175603
Malicious code in webdriver-mocha-isostasy-arcturus-eslint-config npm...
EUVD-2025-175618
Malicious code in webdriver-manager-bulma-pino-pretty-hercules npm...
EUVD-2025-180039
Malicious code in blackhole-jupiter-spectron-webdriver-meteor npm...
EUVD-2025-175617
Malicious code in webdriver-manager-cosmos-mongoose-got npm...