CVE-2016-10534

CVE-2016-10534 affects electron-packager where the --strict-ssl option is defaulted to false in versions 5.2.1–6.0.0 and 6.0.0–6.0.2 unless explicitly set to true. This enables potential MITM attacks during Electron downloads for supported targets. Connected advisories corroborate the MITM risk a...

Man-in-the-Middle (MitM)

electron-packager is vulnerable to man-in-the-middle MitM attacks. The application by default sets the --strict-ssl variable to false, disabling SSL certificate validation. This can allow an attacker on an adjacent network to conduct a MitM attack during the electron package installation step...