GitHub Advisoryadvisory · npm
GHSA-hv96-xxx2-5v7w Downloads Resources over HTTP in nw
HIGH
Official page ↗
- Aliases
- CVE-2016-10588
- Ecosystem
- npm
- Packages
- nw
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-311
- Reviewed
- 2020-06-16
Affected packages
• npm nw: < 0.23.6-1 → fixed in 0.23.6-1
Description
Affected versions of `nw` insecurely download an executable over an unencrypted HTTP connection.
In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `nw`.
Recommendation
Update to version 0.23.6-1 or later.
Related
Alias · CVE (1)
- CVE-2016-10588 nw is an installer for nw.js. vulnerability
Weakness · CWE (1)
- CWE-311 Missing Encryption of Sensitive Data weakness