/Vulnerability Library

Selenium Grid < 4.0.0-alpha-7 - Remote Code Execution

CVE-2022-28108
Early Release

Description

Selenium Server (Grid) before 4.0.0-alpha-7 permits unauthenticated session creation and unsafe capability injection via /wd/hub/session due to missing Origin validation and weak content-type enforcement.

Severity

Critical

CVSS Score

9.8

Affected Product

selenium_grid

Published Date

April 14, 2026

Template Author

t0xk

CVE-2022-28108.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2022-28108
CWE ID:
cwe-352

References

https://nvd.nist.gov/vuln/detail/CVE-2022-28108https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/https://github.com/SeleniumHQ/selenium/blob/trunk/java/CHANGELOG

Remediation Steps

Upgrade to Selenium Server 4.0.0-alpha-7 or later and restrict network exposure.