WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to r…
Critical CVSS 9.8
Summary
WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to remote code execution (RCE) in test orchestration. Git permits branch names containing shell metacharacters, and getGitMetadataForAISelection() interpolates these names directly into execSync() calls without sanitization. An attacker can exploit this by supplying a malicious repository (via testOrche…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://github.com/webdriverio/webdriverio/blob/ea0e3e00288abced4c739ff9e46c46977b7cdbd2/packages/wdio-browserstack-service/src/testorchestration/helpers.ts#L204 Product
- https://github.com/webdriverio/webdriverio/releases/tag/v9.24.0 Product
- https://github.com/webdriverio/webdriverio/security/advisories/GHSA-5c46-x3qw-q7j7 Exploit
- https://access.redhat.com/security/cve/CVE-2026-25244
- https://bugzilla.redhat.com/show_bug.cgi?id=2479692
- https://github.com/webdriverio/webdriverio/security/advisories/GHSA-5c46-x3qw-q7j7 Exploit
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25244.json
Timeline
- nvd_ingest NVD