CVE-2016-10583: Insecure Download of Executable in closure-util

closure-util Updated 02 Oct 2025

Summary

18/02/2019

Disclosed on

CVE-2016-10583

CVE

No i

Fix available

High

Severity

8.1

CVSS Score

CVE-2016-10583: closure-util downloads Resources over HTTP. Affects closure-util versions < 2.0.0-beta.1. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

closure-util is an npm package used for closure compiler builds. It provides a set of utilities and configurations for managing and optimizing JavaScript code. The package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection.

Vulnerability Detail

The affected versions of closure-util insecurely download an executable over an unencrypted HTTP connection. This vulnerability allows an attacker with a privileged network position to intercept the response and replace the executable with a malicious one. As a result, code execution on the system running closure-util is possible.

How To Fix

No fixed version is published for this vulnerability.

To mitigate this issue, follow these steps:

Install the package using npm's --ignore-scripts flag.
Navigate to the package directory and open default-config.json in a text editor.
Change the download URLs in the compiler_url and library_url fields to their https equivalents.
Run npm i in the package directory to ensure the updated URLs are used for future installations.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

A workaround for this vulnerability is to manually modify the default-config.json file in the package directory. Open the file in a text editor and change the download URLs to use https instead of http. This ensures that the executable is downloaded securely. Remember to run npm i after making the changes to update the package.

Conclusion

The closure-util package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. This can lead to code execution on the system running closure-util. To mitigate the vulnerability, it is recommended to install the package using npm's --ignore-scripts flag and update the download URLs to use https instead of http in the default-config.json file. For more information and assistance, contact DevNack.com.

See every vulnerability recorded for closure-util →

References

How To Fix

No fixed version is published for this vulnerability.

To mitigate this issue, follow these steps:

Install the package using npm's --ignore-scripts flag.
Navigate to the package directory and open default-config.json in a text editor.
Change the download URLs in the compiler_url and library_url fields to their https equivalents.
Run npm i in the package directory to ensure the updated URLs are used for future installations.