chrome-js (>=0.1.8, <=0.2.0), cpos (>=0.1.3, <=0.1.9) +26 more potentially affected by CVE-2016-10580 via nodewebkit (>=0.7.5, <=0.11.6)

nodewebkit NPM version =0.7.5, =0.1.8, =0.1.3, =0.1.0, =0.0.1, =0.1.0, =0.0.0, =0.0.1, =0.0.0, =0.0.24, =0.0.6, =1.6.1, =0.0.0, =0.1.0, =1.0.1, =1.0.2 and more Source cves: CVE-2016-10580 Source advisory: OSV:GHSA-GC6C-5V9W-XMHW...

CVE-2016-10580

Summary: nodewebkit downloads zipped resources over HTTP, which enables MITM modification of the downloaded payload to execute arbitrary code on the host. In exposed network positions, an attacker can intercept and swap the zip file, leading to potential RCE on systems running nodewebkit. Public ...