VEXselenium-node-firefox
selenium-node-firefox
3 declaraciones, emitidas el .Cada una es un hallazgo del escáner que no es explotable en esta imagen, y el motivo.
@id https://quench-works.com/vex/selenium-node-firefox/2026-11-01
CVE-2026-115905
no afectado · código vulnerable fuera de la ruta de ejecución- zip 2.4.2
The advisory: ZipStreamReader (src/read/stream.rs) extracts by Local File Header names while ZipArchive trusts the Central Directory; exploitation needs the streaming reader, which geckodriver never uses. geckodriver here is Wolfi's geckodriver 0.37.1 apk (/usr/bin/geckodriver); 0.37.1 is the newest upstream release (2026-07-20). Its Cargo.toml:49 declares zip with default-features = false and features ["deflate-flate2", "flate2"], Cargo.lock resolves zip 2.4.2 with geckodriver as its only dependent, and the crate is used only by unzip_buffer in src/capabilities.rs:819 (called at :579 for the moz:firefoxOptions profile): zip::ZipArchive::new over an in-memory Cursor (:821), then by_index (:829), an explicit rejection of symlink entries, enclosed_name(), and its own file writes. Verified 2026-11-01 on the v0.37.1 source: grep -rnE 'zip::|ZipArchive|ZipWriter|\.extract\(|read_zipfile_from_stream|ZipStreamReader|by_index|by_name' src returns only capabilities.rs:821 and :829.
CVE-2026-115906
no afectado · código vulnerable ausente- zip 2.4.2
The advisory: the AES entry reader (src/aes.rs) skips its HMAC check on premature EOF. That reader exists only with zip's aes-crypto feature, which geckodriver does not enable, so the AES code is not compiled in. geckodriver here is Wolfi's geckodriver 0.37.1 apk (/usr/bin/geckodriver); 0.37.1 is the newest upstream release (2026-07-20). Its Cargo.toml:49 declares zip with default-features = false and features ["deflate-flate2", "flate2"], Cargo.lock resolves zip 2.4.2 with geckodriver as its only dependent, and the crate is used only by unzip_buffer in src/capabilities.rs:819 (called at :579 for the moz:firefoxOptions profile): zip::ZipArchive::new over an in-memory Cursor (:821), then by_index (:829), an explicit rejection of symlink entries, enclosed_name(), and its own file writes. Verified 2026-11-01 on the v0.37.1 source: grep -rnE 'zip::|ZipArchive|ZipWriter|\.extract\(|read_zipfile_from_stream|ZipStreamReader|by_index|by_name' src returns only capabilities.rs:821 and :829.
CVE-2026-115909
no afectado · código vulnerable fuera de la ruta de ejecución- zip 2.4.2
The advisory: ZipArchive::extract preallocates a symlink target from an attacker-controlled ZIP64 size. ZipArchive::extract is never called, and geckodriver refuses symlink entries outright. geckodriver here is Wolfi's geckodriver 0.37.1 apk (/usr/bin/geckodriver); 0.37.1 is the newest upstream release (2026-07-20). Its Cargo.toml:49 declares zip with default-features = false and features ["deflate-flate2", "flate2"], Cargo.lock resolves zip 2.4.2 with geckodriver as its only dependent, and the crate is used only by unzip_buffer in src/capabilities.rs:819 (called at :579 for the moz:firefoxOptions profile): zip::ZipArchive::new over an in-memory Cursor (:821), then by_index (:829), an explicit rejection of symlink entries, enclosed_name(), and its own file writes. Verified 2026-11-01 on the v0.37.1 source: grep -rnE 'zip::|ZipArchive|ZipWriter|\.extract\(|read_zipfile_from_stream|ZipStreamReader|by_index|by_name' src returns only capabilities.rs:821 and :829.