CVE-2022-28108: Selenium Grid

High severity, CVSS 8.8. EPSS: 11.7% chance of exploitation in the next 30 days.

Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.

Affected products

• Selenium Selenium Grid: before 4.0.0 (fixed in 4.0.0); version 4.0.0 only

Published 2022-04-19. Last modified 2026-06-17.