macaca-android-dingtalk (=1.0.30) potentially affected by CVE-2016-10586 via macaca-chromedriver (=1.0.15)

macaca-chromedriver NPM version =1.0.15 is affected by a known vulnerability. The following packages have a transitive dependency on macaca-chromedriver and may be impacted: - macaca-android-dingtalk =1.0.30 Source cves: CVE-2016-10586 Source advisory: OSV:GHSA-769C-QPHH-G3WM...

CVE-2016-10586

macaca-chromedriver is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver before 1.0.29 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker...

CVE-2016-10586

CVE-2016-10586 affects the macaca-chromedriver Node.js wrapper for Selenium’s chromedriver. The vulnerability arises because it downloads binary resources over HTTP, enabling a man-in-the-middle (MITM) attacker to swap the requested binary with a malicious one, potentially causing remote code exe...