# Risk map — webdriverio/webdriverio

> Canonical page: https://codevetter.com/unpack/webdriverio/risk-map

# Risk map — webdriverio/webdriverio

Scanned commit dbf0f497130676040ce4212d9cf6459adfe16c42 (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. The most consequential boundaries accept executable configuration, launch processes, communicate with drivers, and write caller-selected artifacts. Credential transport and logging depend on protocol and masking choices. Testing configuration and browser compatibility branches also create limits on what source inspection alone can establish.
- Configuration and plugins are executable inputs: ConfigParser imports the selected config module, initializePlugin imports scoped/absolute or convention-derived modules, and automationProtocol can select a dynamically imported driver. — [packages/wdio-config/src/node/ConfigParser.ts#L136-L145](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/wdio-config/src/node/ConfigParser.ts#L136-L145) [packages/wdio-config/src/node/FileSystemPathService.ts#L19-L23](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/wdio-config/src/node/FileSystemPathService.ts#L19-L23) [packages/wdio-utils/src/initializePlugin.ts#L15-L45](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/wdio-utils/src/initializePlugin.ts#L15-L45) [packages/webdriverio/src/utils/driver.ts#L28-L40](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/webdriverio/src/utils/driver.ts#L28-L40)
- Process-launch boundaries inherit environment settings and accept runtime arguments; Chromium startup can download/select a driver binary, defaults allowedOrigins to '*' and allowedIps to '0.0.0.0', and accepts spawnOpts overrides. — [packages/wdio-local-runner/src/worker.ts#L123-L165](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/wdio-local-runner/src/worker.ts#L123-L165) [packages/wdio-utils/src/node/startWebDriver.ts#L145-L158](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/wdio-utils/src/node/startWebDriver.ts#L145-L158)
- BiDi connection options follow up to ten redirects and forward custom headers; strictSSL=false disables certificate verification. The source explicitly identifies cross-host credential forwarding as a consequence of misconfigured redirects. — [packages/webdriver/src/utils.ts#L459-L479](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/webdriver/src/utils.ts#L459-L479)
- HTTP session authentication uses a Basic header on /session. LambdaTest auto-detection defaults to HTTP port 80 unless overridden, and enabled Appium direct connection replaces host/protocol/path/port from returned capabilities. — [packages/webdriver/src/request/request.ts#L136-L146](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/webdriver/src/request/request.ts#L136-L146) [packages/webdriverio/src/utils/detectBackend.ts#L99-L105](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/webdriverio/src/utils/detectBackend.ts#L99-L105) [packages/webdriver/src/index.ts#L89-L98](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/webdriver/src/index.ts#L89-L98) [packages/webdriver/src/utils.ts#L383-L397](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/webdriver/src/utils.ts#L383-L397)
- Input masking covers selected request/log payloads, but command result values are logged; the e2e masked-input example explicitly warns that a later getValue exposes the password in logs. — [packages/webdriver/src/command.ts#L137-L168](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/webdriver/src/command.ts#L137-L168) [packages/webdriver/src/command.ts#L175-L188](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/webdriver/src/command.ts#L175-L188) [e2e/wdio/headless/test.e2e.ts#L51-L59](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/e2e/wdio/headless/test.e2e.ts#L51-L59)
- Screenshot writes resolve caller paths without a repository-root constraint. BrowserRunner.initialize recursively removes an existing configured reports directory when clean is absent or true, so artifact configuration controls filesystem effects. — [packages/webdriverio/src/node/saveScreenshot.ts#L43-L55](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/webdriverio/src/node/saveScreenshot.ts#L43-L55) [packages/wdio-browser-runner/src/index.ts#L49-L50](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/wdio-browser-runner/src/index.ts#L49-L50) [packages/wdio-browser-runner/src/index.ts#L70-L77](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/wdio-browser-runner/src/index.ts#L70-L77)
- Shared-store routes bind to loopback and expose get/set/pool operations without authentication middleware in the inspected chain. validateBody checks only paths ending /get or /set, while the primary setter is POST /; this mismatch warrants investigation, not a confirmed exploit claim. — [packages/wdio-shared-store-service/src/server.ts#L15-L44](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/wdio-shared-store-service/src/server.ts#L15-L44) [packages/wdio-shared-store-service/src/server.ts#L115-L121](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/wdio-shared-store-service/src/server.ts#L115-L121)
- Hypothesis: compatibility regressions may escape narrow mocked checks because locator behavior combines protocol fallbacks, browser-version workarounds, shadow-root state, and stale-element recovery, while unit configuration suppresses unhandled-error and default coverage signals. (inferred) — [packages/webdriverio/src/utils/index.ts#L494-L521](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/webdriverio/src/utils/index.ts#L494-L521) [packages/webdriverio/src/utils/index.ts#L577-L668](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/webdriverio/src/utils/index.ts#L577-L668) [packages/webdriverio/src/middlewares.ts#L43-L73](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/packages/webdriverio/src/middlewares.ts#L43-L73) [vitest.config.ts#L5-L9](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/vitest.config.ts#L5-L9) [vitest.config.ts#L23-L32](https://github.com/webdriverio/webdriverio/blob/dbf0f497130676040ce4212d9cf6459adfe16c42/vitest.config.ts#L23-L32)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)