CVE-2016-10597: Insecure Download of Executable in cobalt-cli
Summary
CVE-2016-10597: Downloads Resources over HTTP in cobalt-cli. Affects cobalt-cli versions < 2.5.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
cobalt-cli is an npm package used for [provide brief description of the package's functionality and key attributes]. It is vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The affected versions of cobalt-cli insecurely download an executable over an unencrypted HTTP connection. This vulnerability allows an attacker with a privileged network position to intercept the response and replace the executable with a malicious one. As a result, code execution on the system running cobalt-cli can be achieved. The risk of exploitation is higher when connected to a public network, but even on a private network, it can be exploited by those who have compromised the network or have privileged access to the ISP.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The cobalt-cli package is vulnerable to an insecure download of an executable over an unencrypted HTTP connection. It is recommended to avoid using this package and opt for a different one if possible. Monitor for updates and patches, and ensure network security if using cobalt-cli on a private network. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for cobalt-cli →
FAQ
cobalt-cli is an npm package used for [provide brief description of the package's functionality and key attributes].
The vulnerability allows an attacker to replace the downloaded executable with a malicious one, resulting in code execution on the system running cobalt-cli.
Avoid using cobalt-cli and choose an alternative package. If using cobalt-cli on a private network, ensure network security and monitor for updates and patches.
No, there is currently no patch available for this vulnerability.
For more information, you can refer to the GitHub Security Advisory database or contact the package maintainer.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
