CVE-2016-10638: Insecure Download of Executable in js-given
Summary
CVE-2016-10638: Downloads Resources over HTTP in js-given. Affects js-given versions < 0.0.18. Fixed in 0.0.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
js-given is an npm package that provides a testing framework for JavaScript applications. It allows developers to write human-readable test scenarios using a Given-When-Then syntax. The package is widely used in the JavaScript ecosystem for testing purposes. However, certain versions of js-given are vulnerable to an insecure download of an executable over an unencrypted HTTP connection.
Vulnerability Detail
The affected versions of js-given insecurely download an executable over an unencrypted HTTP connection. This vulnerability can be exploited by an attacker with a privileged network position. They can intercept the response and replace the executable with a malicious one. If the compromised executable is executed on the system running js-given, it can lead to arbitrary code execution.
How To Fix
Minimum fixed version
0.0.18
This is the first release that contains the fix.
npm install js-given@0.0.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in js-given allows for the insecure download of an executable, which can be replaced by an attacker with a malicious one. To mitigate this risk, it is crucial to update to version 0.0.18 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for js-given →
FAQ
js-given is an npm package that provides a testing framework for JavaScript applications. It allows developers to write human-readable test scenarios using a Given-When-Then syntax.
The vulnerability allows an attacker with a privileged network position to intercept the download of an executable and replace it with a malicious one. This can lead to arbitrary code execution on the system running js-given.
To fix this vulnerability, update your js-given package to version 0.0.18 or later.
No, only versions prior to 0.0.18 are affected. Updating to version 0.0.18 or later resolves the vulnerability.
No, the recommended fix is to update to a secure version of js-given.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.