jdf (>=1.7.7, <=2.1.18), yrd (>=0.0.65, <=1.0.1) potentially affected by CVE-2016-10595 via jdf-sass (>=1.0.17, <=1.0.18)

jdf-sass NPM version =1.0.17, =1.7.7, =0.0.65, =1.0.1 Source cves: CVE-2016-10595 Source advisory: OSV:GHSA-8CC8-8VVX-FHGW...

CVE-2016-10595

The CVE-2016-10595 issue affects the jdf-sass package, a fork of node-sass, which downloads resources over HTTP. The underlying root cause is unencrypted HTTP transfers allowing an attacker with a privileged network position to MITM the responses and swap in a malicious executable, potentially le...