CVE-2016-10565: operadriver - Downloads Resources over HTTP
Summary
CVE-2016-10565: Downloads Resources over HTTP in operadriver. Affects operadriver versions < 0.2.3. Fixed in 0.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
operadriver is a Opera Driver for Selenium. It is used as a WebDriver implementation to automate Opera browser actions. operadriver versions below 0.2.3 have a vulnerability where they download binary resources over HTTP instead of HTTPS. This leaves the driver susceptible to Man-in-the-Middle (MITM) attacks. An attacker on the network can intercept the download and replace the requested binary with a malicious one, potentially leading to remote code execution (RCE) on the user's system.
Vulnerability Detail
The vulnerability in operadriver versions below 0.2.3 stems from the insecure downloading of binary resources over HTTP. This allows an attacker with network access to intercept the download and replace the requested binary with a malicious one. If the user executes the downloaded binary, it could lead to remote code execution on their system. The vulnerability has a high severity rating and is classified under CWE-311.
How To Fix
Latest published version: 1.0.0 as of 22 Oct 2026
npm install operadriver@1.0.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.2.3
This is the first release that contains the fix.
npm install operadriver@0.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update operadriver to the latest secure version.
Conclusion
operadriver versions below 0.2.3 are vulnerable to downloading binary resources over HTTP, which can be exploited by an attacker for remote code execution. It is crucial to update to version 0.2.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for operadriver →
FAQ
operadriver is a WebDriver implementation for automating Opera browser actions.
The vulnerability allows an attacker to replace downloaded binary resources with malicious ones, potentially leading to remote code execution on the user's system.
Update operadriver to version 0.2.3 or later to ensure secure downloading of binary resources.
There is no specific workaround mentioned. Updating to the latest secure version is the recommended solution.
The vulnerability has a high severity rating.
