CVE-2026-25244

[CVE catalog]

Severity

Critical · CVSS 9.8

Published

May 18, 2026, 8:31:14 PM UTC

Source

[NVD] · [CVE record]

EPSS

3.31% · Oct 25, 2026

A flaw was found in WebdriverIO. A remote attacker can exploit a command injection vulnerability by crafting a malicious Git repository with a specially named branch. This branch name, containing shell metacharacters, is unsafely processed during test orchestration. This allows for remote code execution on affected systems, potentially leading to the disclosure of sensitive information, system compromise, and supply chain attacks. WebdriverIO: WebdriverIO: Remote Code Execution via command injection in Git branch name processing This vulnerability is rated as Important by Red Hat. Successful exploitation requires the attacker to gain access to or influence the Git repository being processed to supply a malicious branch name; this generally requires at least minimal permissions to be able to modify scm-controlled content. Additionally, user interaction is required since the vulnerability requires the target to check out a repository or process a pull request. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.