backender (>=0.0.1 <=0.0.7), gulp-backender (>=0.0.4 <=0.0.5) potentially affected by CVE-2016-10604 via dalek-browser-chrome (=0.0.11)

dalek-browser-chrome NPM version =0.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on dalek-browser-chrome and may be impacted: - backender =0.0.1, =0.0.4, =0.0.5 Source cves: CVE-2016-10604 Source advisory: OSV:GHSA-6Q8Q-RVF4-M4PG...

CVE-2016-10604

dalek-browser-chrome is Google Chrome bindings for DalekJS. dalek-browser-chrome downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the...

CVE-2016-10604

dalek-browser-chrome downloads binary resources over HTTP, enabling MITM-style tampering. In network-position scenarios, an attacker can swap the requested binary with a malicious one, potentially executing code on the user’s system. The advisory notes that no patch is currently available and rec...