What is GHSA-mm7h-323r-9p4g?

GHSA-mm7h-323r-9p4g is a security advisory published by GitHub Security Advisories with High severity. Downloads Resources over HTTP in imageoptim

Which CVE IDs does GHSA-mm7h-323r-9p4g cover?

GHSA-mm7h-323r-9p4g covers the following CVE IDs: CVE-2016-10596. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-mm7h-323r-9p4g?

GHSA-mm7h-323r-9p4g affects 1 product, including: npm/imageoptim:\u003c= 0.5.0.

GHSA-mm7h-323r-9p4gHigh

Downloads Resources over HTTP in imageoptim

Vendor

GitHub Security Advisories

Published

February 18, 2019

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2016-10596 →

📋 Description

imageoptim is a Node.js wrapper for some images compression algorithms.

imageoptim downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested tarball with an attacker controlled tarball if the attacker is on the network or positioned in between the user and the remote server.

Recommendation

No fix is currently available for this vulnerability.

It is our recommendation to not install or use this module at this time.

🎯 Affected products1

npm/imageoptim:<= 0.5.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2016-10596
https://github.com/advisories/GHSA-mm7h-323r-9p4g
https://www.npmjs.com/advisories/194