CVE-2016-10574: Insecure Download of Resources in apk-parser3

apk-parser3 Updated 02 Oct 2025

Summary

01/09/2020

Disclosed on

CVE-2016-10574

CVE

Yes i

Fix available

High

Severity

Not published

CVSS Score

CVE-2016-10574: Downloads Resources over HTTP in apk-parser3. Affects apk-parser3 versions < 0.1.3. Fixed in 0.1.3. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

apk-parser3 is an npm package used for parsing APK files. It allows developers to extract information and resources from APK files. However, versions of apk-parser3 prior to 0.1.3 insecurely download an executable over an unencrypted HTTP connection. This vulnerability exposes the package to potential code execution attacks if an attacker has a privileged network position and can intercept the response to replace the executable with a malicious one.

Vulnerability Detail

The vulnerability in apk-parser3 arises from the insecure download of an executable over an unencrypted HTTP connection. This means that an attacker with a privileged network position can intercept the response and replace the executable with a malicious one. As a result, when the system running apk-parser3 executes the downloaded executable, it will unknowingly execute the malicious code instead. This can lead to various security issues and compromise the integrity of the system.

How To Fix

Minimum fixed version

0.1.3

This is the first release that contains the fix.

npm install apk-parser3@0.1.3

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability. The recommended solution is to update to the latest version of apk-parser3.

Conclusion

In conclusion, the vulnerability in apk-parser3 allows for the insecure download of an executable over an unencrypted HTTP connection. This can be exploited by an attacker to replace the executable with malicious code, leading to potential code execution on the system. To mitigate this vulnerability, it is crucial to update to version 0.1.3 or later of apk-parser3. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for apk-parser3 →