anione (>=1.2.0 <=1.2.7), gulp-imageoptim (=0.1.0) potentially affected by CVE-2016-10596 via imageoptim (>=0.3.4 <=0.4.2)

imageoptim NPM version =0.3.4, =1.2.0, =1.2.7 - gulp-imageoptim =0.1.0 Source cves: CVE-2016-10596 Source advisory: OSV:GHSA-MM7H-323R-9P4G...

CVE-2016-10596

The CVE-2016-10596 entry concerns imageoptim, a Node.js wrapper for image compression algorithms. The vulnerability arises because it downloads zipped resources over HTTP, enabling MITM attacks. A remote code execution (RCE) could be possible if an attacker swaps the tarball with a malicious one ...