@dequelabs/amaze-tdd (>=0.2.9, <=0.3.2), @holisticon/angularjs-common (>=0.2.0-23, <=0.5.3) +15 more potentially affected by CVE-2016-10579 via chromedriver (>=2.10.0, <=2.25.1)

chromedriver NPM version =2.10.0, =0.2.9, =0.2.0-23, =0.2.6, =0.0.5, =0.0.10, =1.3.2, =0.0.1, =0.1.0, =1.0.0, =1.3.9, =0.0.1, =1.4.23, =4.0.0 - testarmada-performance-reporter 1.1.1 and more Source cves: CVE-2016-10579 Source advisory: OSV:GHSA-JH5W-6964-X5CF...

CVE-2016-10579

Chromedriver (the NPM wrapper for selenium ChromeDriver) before version 2.26.1 downloads binary resources over HTTP, enabling MitM modification or interception of the downloaded binary. This can potentially lead to remote code execution if an attacker on the network swaps the binary with a malici...