libsbmlsim (>=0.0.1, <=0.0.2) potentially affected by CVE-2016-10642 via cmake (0.0.1)

cmake NPM version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on cmake and may be impacted: - libsbmlsim =0.0.1, =0.0.2 Source cves: CVE-2016-10642 Source advisory: OSV:GHSA-4J59-HFW6-6W7H...

CVE-2016-10642

The CVE-2016-10642 entry corresponds to cmake downloading binary resources over HTTP, enabling MITM and potential remote code execution if an attacker is on the network. Connected sources (GHSA-4J59-HFW6-6W7H and OSV) confirm that affected cmake versions insecurely fetch executables via unencrypt...