GHSA-g95j-p8f6-pwh4HighCVSS 8.1
headless-browser-lite downloads Resources over HTTP
🔗 CVE IDs covered (1)
📋 Description
Affected versions of headless-browser-lite insecurely download an executable over an unencrypted HTTP connection.
In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running headless-browser-lite.
Recommendation
Update to version 2015.4.18-a or later.
🎯 Affected products1
- npm/headless-browser-lite:<= 2015.4.3-10
🔗 References (5)
- https://nvd.nist.gov/vuln/detail/CVE-2016-10625
- https://github.com/advisories/GHSA-g95j-p8f6-pwh4
- https://www.npmjs.com/advisories/230
- https://github.com/kaizhu256/node-phantomjs-lite/commit/96f766e5674e8462b5f5bbd4494390988f0a3916
- https://github.com/kaizhu256/node-phantomjs-lite/commit/f6e2a9489446a1dabe175aa8c14a1c55ca824520